Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 17, 2021, 11:33 p.m.	March 17, 2021, 11:38 p.m.

Size	2.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`37b2f2b402c9fd67af523ce7a4ed160b`
SHA256	`4832d7872fbda09f9b51735611d372ff1a6004dc8d821d2f2e26fdbdfc300021`
CRC32	`92926E2E`
ssdeep	`49152:Kcq8z+DB/HE21C8YwN2vVV94l8bugqEVSCwwt+t069GRwZv22h:E8QhHE2oqWal8SSVSSna22h`
PDB Path	wextract.pdb
Yara	Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature Zero Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet escalate_priv - Escalade priviledges screenshot - Take screenshot win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token win_private_profile - Affect private profile win_files_operation - Affect private profile IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check HasDigitalSignature - DigitalSignature Check HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

word.txt "C:\Users\test22\AppData\Local\Temp\word.txt"
1116
- cmd.exe cmd /c HPGHDTBw
  2208
- cmd.exe cmd /c cmd < Sfaldavano.pst
  2252
  - cmd.exe cmd
    2624
    - findstr.exe findstr /V /R "^DAusbwHDRImZwNeAvSaaeRCUfSKlkPBXNHsnjoVEwmOniHPNLWxMOutMYkeEsbaeiCjzcDhhXOdCerNHrWnfcOoGD$" Tramonto.accdt
      2664
    - certutil.exe certutil -decode Debbano.adt c
      1632
    - Vigilanza.com Vigilanza.com c
      240
      - Vigilanza.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com c
        2936
    - PING.EXE ping 127.0.0.1 -n 30
      2356

Name	Response	Post-Analysis Lookup
euzpdpTPHvaakOPTnKc.euzpdpTPHvaakOPTnKc

IP Address	Status	Action
164.124.101.2	Active	Moloch
216.239.36.21	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 17, 2021, 11:31 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2021, 11:31 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:31 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:31 p.m.			0	0
IsDebuggerPresent March 17, 2021, 11:31 p.m.			0	0

Command line console output was observed (50 out of 1354 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: 'HPGHDTBw' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set kZPJvSDe=8 console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set fiHbGjQEXstfjtRhZBkWAoTbgKzPAqYEPbjIIcaDsNTsFWMKRoSw=FEigppWSwtWzmmOSpEEpHFMgBSsXIXsoWNlSyzmjvKfJXYubXSHDhSpZRSMsRYlrMNvMgWMPysMWfrsDLUqPdOUtDkwhHixnAjWpCxowuSbVyhJOAoFXYxNYSsorVmiYXgvruiwsLYJbdYYdBjNnBbAynYslkyuHKmYRQFHaigkZLfITzSCI console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set JvmNdFiQRyGSwNQqimVFxshkAzodbRzCnVwrmtAqmBdpFiKCRTkzHessohjXvRzZLrzuMMA=ZUySqrFzJGnEFqVcDJVkRDDIodbCNDPyzoxMXndyHThQaOxLiYCrRgkvsbKKFrFuRzkvGpbyaPEXfNdzVMxPqM console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set tXYxAOGmEhiZYDYtYAbKwKguEudOTIQytyumIOXdLdZKiNsPXHvgDwjzJ=QzbSGVveUSbmvpDuYLKDYQPAQkjCBeTMQQXDSTKthySnabljLvrAJySZEXwxJUARZKJFkZhywGdSYdoaqZRtZarKXYZVSfcaEwmIOFqLpYmeOqwhOIxJrcRGGYIhqsjMkXgXRAEcZyVwTqVXWLupVLfppTwPWMLRLNRRMtvgtYKYmPMGeKsg console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set eQmItNXnOnjxtdyotkRfSyWwsJzuxMjcvGIWapHdnPfmnDxmHbYnAZaX=bscxRrwjQXnIpQVEAQeQvDNgTmXONVbhLeURjWHLghHFVQnHrUZodubUDuAsuhnVAkXuVraEodCpVoaewfKTVgXEEZgycfFqOLtKTsMZBcZZEgZcNbdQCFqkgzCVPjpSLBxlrIpKDKsAgXZfqSsXZOnpKTcAOQlfjigrUOaygGhRhAWdxhVWUkTWelm console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set jJVNAegiJVxkAjIaBHVlWyuBVgxqhswKfoSFKmskjOHnSJcICAcxggh=DxRkIhUaTKWaxrHwdKYibHJjSLbMVGcqULedIyDYUgEiMegnTztEfyJVLFaWPivhfWbIwszkiqhoeCAPbZTBBQKOwuFrMGpMS console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set RQFFbBqTbfSASptCnQgVLnkJHVMfnARAdLKKlSBsAIzcVAhvYpoabXFaEVX=PLxWnalinxaFgXxrtPNuIfsfanezusyfVqBPhbXDdyXDRCtACChPoQTmzyDZfQwufeKgcEPHSpQCaNnQxCQEtdutuwcoTXgmtQgORQyYMGWYqsiGHNFNZbeYWGizoHNUVdbBnJYEbSRbzor console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set UPAyaBmHOdSkILPtSweKUFiXPwdiFEENDamzuHCxQPNoRMVLrNFsyzUgHDddkaepLtIfjvXkm=TtSZueyErRZjIpnlLDskpbNDbMtFmGPxSbmQvIvhkGgllnvnReKzThncsgCzYmyveFxlKHNrirqCoCzYdFOvWcAEYrmoyrfLBRoFtkOlgHjQhVjOVDeaLIAGtPjGoFXrOgwsxNUyREigpKseQLjCwWqSdCAgYiw console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set KpwZUVziIXBiAjvxnlPbzceSgpqRhGuJCnEZIaoVstTrcTstyuQOsEdgupLKVCUeQREwHv=yeUugCYbxRVMiPaaYofTmHbZOpQhDgfvIxKMvbwMoLdTZPNhnmGTaDknEVsyLLTuBnrMtFVAuCLNdDZZcCOtIvtyokiBuWqvSpaBMwoSEyNPSbiwVaJpWPntxYDSnzxlCgViknhxxWADJfjLtuGNhRmrLhuNbfxlKChECq console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set bygOqgVcy=o console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set OaNGWKOSvXsmWtBfSuwIorfoIYrmOQRwwFAebrGCPJESyFsKmZefrrJLeEYXHftGyfnsDmSPmnS=nbeeGaZONCYXVPqSyIVmFYMQiquZijPEkljECVdgffSDsAcNmZKRDzUAKjVGjqHAMzMLDcdpsHlfuonHEaAoCYwRdMTfqKefIsQYOKlrIAmWpExCOgwTmmXOsUxQCwpHEUGOaATTib console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set enyILssBMIoPpzeGTfzBHdSsgYFpgxoLeZVdjkJnlmbYctvxdTZDOVRLFNxNMihs=bNpnLxHGUdoSUVlBkTxcEXuopKnRWMejubYdjWEmsXTEJTLSlkAhSVWmGwgwVQKigVLvXTfffVtGtBmdYGHKjOxkBnKkHCDAhLdNifVdWkYXRfcyBYrfpZVmBAUnprHNsDzzkLoILdOqQ console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set zjeFJIngsgPRjHcviSDlFgVeTQPcESlUIruIcExYgrkyDxnBhgoVbGRydqLTSrK=rUooANqDnEVCrQmmsgifKgbejqscSAykaMwIkfqmgEbSKfeABjBEVxOObuWmcELXnJpsOQhwgIwyREsWYRUGYBfYXhkyaAtJTmxqyLLKZAdhzJXTPZBEKtYWxkzBFiINEskspdRhy console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set HnkeEhfsdzZmZPAbGUslyRRCJwnFJnohmAbALsGukhQfOtavRMJXWUt=HJaCOJIRlLqmsqLghlYSqBOEJeOWPksEcHSeZtsBEYyetStQqxJLVjPyUNSMVMeYxcrKoJfoTbhwvMARXXVxBGIpSMikkEFSWuHIOzIstBSnYNJohwOYQHbONUScBtXgRcyftReEgEfqOllteZYlQHwgJTVUBhPqDDHCHxtcZlJjsvqC console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set NaCuNnpxRGlWoewOfvlCIbIUClFYPWhTalOUhUQyboQNTmRoHbeZPZwfJIDCSlEUasDXhu=xFyymGVwrzbdsUhraonkFsgjhDWxCWTUBWHzKUCJOHAocThqyglPOVWrsSSVKAmimCPcjUabGPvYRyQzdWfhLtuFZEeReGZgiaJTrRNkVMoZnYjkenEOlkccvlvIRBcZQoQnvXfmotaYVuu console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set sQPEwktWXhbTcyzzsopdoOOtoyFySbmfrcdwLQYEtTAomvteLY=NWQSDwKcWFYtmOiQqPsIAlEjfhGFMwDxTQMahCNZqcwZyOwzaFrhzduCaDDfcyIVeElJeODbwaHtpEuAjjhuXfqDJpqJZbEVNyXBEssDeGkwIwzNberoSBYMEHZTOUnENMsrHFWUVKrsrYUIQjkWxcekilWW console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set bOoiHgWJfuRuohobHIGMseCIBlaJyVvIZCbVVpvKYYAuxQkoUOABdlqcjAFv=jDzJpuFPjCbjWOaBchLYlPscUsPCeJxDZOMxuvkJGaHkefxcITQhUbLvjYORdrNDiTjieXxYewaRoyaFXzTpSiJCefooIxaCFtrorjzKnRlSyTguFpTXpDKqlKtMOjdIJQjrwpCKqpKqWRvpweCmAczwzrYaiHWjBCpfHltcGoWqTJrahVKMJRihvlKYkp console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set ahnmxIiBRYuSsnzoKZGykWpCJcVSbAylvFENcpJKyxTOCZPOreZYFtscrVQZMfrsSW=MUFNAdVZRrcZKFiOcAuFagoJmzKXQdCVGDrTbfmIJyAaHWyzFAIQLdrbMWguFYpABmauBhsuqnVjOPwChdsfILlfAGiBqaeKWqRiDZSapCQhcQJWULTfGTRPfeGVyPyIc console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set dOYUYgnZuuVWUJWkHfmNteowSAaXjzboRpmVYqMERGMLUzoXYUoPoIug=WwbVAMNINtKpwhHDVVbdvinacYakHZprkfwYgIdTYeigbNWHAjhMIXoPDyACxCwNVHXMkJgjFEszZlVIeLKcLbxgujxpoOmvwzaQPlcRYwitFOPapSmJSGwnjJFYgyrRtVaFSySSfTbKffIsbeZdgQEca console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set DuEbCSXdq=b console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set pAtZHzYpsoXqgBkyNCgsXhXCLhSdENZfYVhCUdGvFkqLGudVdNlNLamWCCgxBIF=oHwzgJlvVRMLjjVFXWZQCjDGcdZawjVWGvDYtXHHCNRUFOKdGJvEIOwWrxXXJScJWPtPIWAqgagPxJwHGJLaPdhScHVJZKXJaoXPJUHJpvddAkBzzddqieUFCjxwwQqExEbjMkXMwwoaqXspyCdJz console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set CfgahbAFIavLVWOgHiaEYuTBFFUlWmmdlbwiYzYAjvaQWgwccRUosPYvcMMIDdJpTyBnUGfhpSsCNr=dDnOtEsZxmFMjHfWVMpXQNDBPBHZmbcJsictyBEEByuYgUrGTVcPDuODqWZDXaAWrWxtkkRxiFcLGEjUbwyDeGykzSroCqHpFpVamYxItwHXLeXvJtuVjXUbQpLziJRiYkuvJUxnGvmqYimdVGnnULW console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: Set gbBdhwAxpAZmWANPJIfPbUmIJcnAlzjhgnokatkEWtQboZzxTJOjculxYTHRDZpQgMkna=vFbKTzrwAJerHBEqRigNjmvzwWUqpcOUesjpPLhQdXzYPAaIkhVrlEfXorJXnrStUiqdfckuUbvfunDAEjPVALKnwfqLwfahtgrIAeaPeOpMiZRKAozkhXDpvBgqxmtEtokRcUqBTZSLBYdw console_handle: 0x00000007	1	1
WriteConsoleW March 17, 2021, 11:31 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP> console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2021, 11:31 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 17, 2021, 11:31 p.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd vigilanza+0x32e04 @ 0x1b2e04 vigilanza+0x201f8 @ 0x1a01f8 vigilanza+0x70221 @ 0x1f0221 vigilanza+0x1a8df @ 0x19a8df vigilanza+0x12d7d @ 0x192d7d vigilanza+0xe046 @ 0x18e046 vigilanza+0x124b9 @ 0x1924b9 vigilanza+0x55d6c @ 0x1d5d6c vigilanza+0x13423 @ 0x193423 vigilanza+0xe453 @ 0x18e453 vigilanza+0xdef7 @ 0x18def7 vigilanza+0x3432 @ 0x183432 vigilanza+0x292d @ 0x18292d vigilanza+0x20913 @ 0x1a0913 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x7746e667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x7746e653 registers.esp: 9236540 registers.edi: 51807448 registers.eax: 9236556 registers.ebp: 9236660 registers.edx: 0 registers.ebx: 0 registers.esi: 12124160 registers.ecx: 2147483647	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 17, 2021, 11:31 p.m.

stacktrace:

RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7746f559
RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7746f639
RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7741df95
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757314dd
vigilanza+0x32e04 @ 0x1b2e04
vigilanza+0x201f8 @ 0x1a01f8
vigilanza+0x70221 @ 0x1f0221
vigilanza+0x1a8df @ 0x19a8df
vigilanza+0x12d7d @ 0x192d7d
vigilanza+0xe046 @ 0x18e046
vigilanza+0x124b9 @ 0x1924b9
vigilanza+0x55d6c @ 0x1d5d6c
vigilanza+0x13423 @ 0x193423
vigilanza+0xe453 @ 0x18e453
vigilanza+0xdef7 @ 0x18def7
vigilanza+0x3432 @ 0x183432
vigilanza+0x292d @ 0x18292d
vigilanza+0x20913 @ 0x1a0913
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff
exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653
exception.instruction: jmp 0x7746e667
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 845395
exception.address: 0x7746e653
registers.esp: 9236540
registers.edi: 51807448
registers.eax: 9236556
registers.ebp: 9236660
registers.edx: 0
registers.ebx: 0
registers.esi: 12124160
registers.ecx: 2147483647

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW March 17, 2021, 11:31 p.m.	number_of_free_clusters: 3350514 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW March 17, 2021, 11:31 p.m.	number_of_free_clusters: 3350514 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com
file	C:\Users\test22\AppData\Roaming\ktRgiRvyVL\iGBMcfL.js
file	C:\Users\test22\AppData\Roaming\ktRgiRvyVL\yroPWpvwuS.com

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0028b000', u'virtual_address': u'0x0000c000', u'entropy': 7.955904348371491, u'name': u'.rsrc', u'virtual_size': u'0x0028af71'}

entropy

7.95590434837

description

A section with a high entropy has been found

entropy

0.987673051394

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (45 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over Toredo network	rule	network_toredo
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

ping 127.0.0.1 -n 30

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 472e4a72753dfccc42be8d067e18b81919860590

Communicates with host for which no DNS query was performed (1 event)

host

216.239.36.21

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4075520 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 process_handle: 0x00000224	1	0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0				reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yroPWpvwuS.url

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2936 manipulating memory of non-child process 1756
NtAllocateVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1756 region_size: 4075520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00840000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224	1	0	0
NtProtectVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4075520 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 process_handle: 0x00000224	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2936 injected into non-child 1756
WriteProcessMemory March 17, 2021, 11:31 p.m.	buffer: ÿÿÿÿ ûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1756 process_handle: 0x00000224	1	1	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

DrWeb	Program.Unwanted.2520
CAT-QuickHeal	Trojan.Alien
McAfee	Artemis!37B2F2B402C9
Kaspersky	Trojan.Win32.Alien.lrs
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	Trojan.Win32.Alien.lrs
GData	Win32.Application.iObit.B
Malwarebytes	Trojan.Agent.HDC.Generic
ESET-NOD32	BAT/Agent.PBT
Ikarus	Malware.Win32.AVEvader
Qihoo-360	HEUR/QVM20.1.F5E0.Malware.Gen

Harvests credentials from local email clients (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sfaldavano.pst

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2936 called NtSetContextThread to modify thread in remote process 1756
NtSetContextThread March 17, 2021, 11:31 p.m.	registers.eip: 2000355780 registers.esp: 8650416 registers.edi: 0 registers.eax: 12718864 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 1756	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2624 resumed a thread in remote process 240
NtResumeThread March 17, 2021, 11:31 p.m.	thread_handle: 0x00000094 suspend_count: 0 process_identifier: 240	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49225

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread March 17, 2021, 11:31 p.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 1116	1	0
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2384 thread_handle: 0x00000148 process_identifier: 2208 current_directory: filepath: track: 1 command_line: cmd /c HPGHDTBw filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000144	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2236 thread_handle: 0x00000144 process_identifier: 2252 current_directory: filepath: track: 1 command_line: cmd /c cmd < Sfaldavano.pst filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000148	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2888 thread_handle: 0x00000088 process_identifier: 2624 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2532 thread_handle: 0x0000008c process_identifier: 2664 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^DAusbwHDRImZwNeAvSaaeRCUfSKlkPBXNHsnjoVEwmOniHPNLWxMOutMYkeEsbaeiCjzcDhhXOdCerNHrWnfcOoGD$" Tramonto.accdt filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2840 thread_handle: 0x00000090 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\certutil.exe track: 1 command_line: certutil -decode Debbano.adt c filepath_r: C:\Windows\system32\certutil.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2448 thread_handle: 0x00000094 process_identifier: 240 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com track: 1 command_line: Vigilanza.com c filepath_r: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
NtResumeThread March 17, 2021, 11:31 p.m.	thread_handle: 0x00000094 suspend_count: 0 process_identifier: 240	1	0
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 1852 thread_handle: 0x00000090 process_identifier: 2356 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 -n 30 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000094	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 2364 thread_handle: 0x0000012c process_identifier: 2936 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com c filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000130	1	1
CreateProcessInternalW March 17, 2021, 11:31 p.m.	thread_identifier: 1556 thread_handle: 0x00000220 process_identifier: 1756 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Vigilanza.com filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000224	1	1
NtGetContextThread March 17, 2021, 11:31 p.m.	thread_handle: 0x00000220	1	0
NtAllocateVirtualMemory March 17, 2021, 11:31 p.m.	process_identifier: 1756 region_size: 4075520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x00840000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224	1	0
WriteProcessMemory March 17, 2021, 11:31 p.m.	buffer: base_address: 0x00840000 process_identifier: 1756 process_handle: 0x00000224	1	1
WriteProcessMemory March 17, 2021, 11:31 p.m.	buffer: ÿÿÿÿ ûÿ(üÿPýÿmèÿÿ jHâýÿ± base_address: 0xfffde000 process_identifier: 1756 process_handle: 0x00000224	1	1
NtSetContextThread March 17, 2021, 11:31 p.m.	registers.eip: 2000355780 registers.esp: 8650416 registers.edi: 0 registers.eax: 12718864 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 1756	1	0
NtResumeThread March 17, 2021, 11:31 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2356	1	0

word.txt

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All