popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mbena.exe

  1. Resubmit sample
    Category Machine Started Completed
    FILE s1_win7_x6402 March 19, 2021, 8:15 a.m. March 19, 2021, 8:24 a.m.
    Size 877.0KB
    Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
    MD5 e81cc62679b5e5aa3291b0168b271ee9
    SHA256 aa128e8000ef9197eed67a5b6f27454e0c1b1878ed7546394fde472d42836eb9
    CRC32 657B1C36
    ssdeep 12288:drj1SX8P9VVigVZNABK/rTR8Wjw8FP+mQ2AItCKfXjNqX9xQjToBfATE5:6XmOgTeBWr9Vl+XfgpI8oBfATE
    Yara
    • PE_Header_Zero - PE File Signature Zero
    • IsPE32 - (no description)
    • IsNET_EXE - (no description)
    • IsWindowsGUI - (no description)
    • IsPacked - Entropy Check
    • Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult

    Name Response Post-Analysis Lookup
    No hosts contacted.
    IP Address Status Action
    172.217.25.14 Active Moloch

    Suricata Alerts

    No Suricata Alerts

    Suricata TLS

    No Suricata TLS

    Time & API Arguments Status Return Repeated

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0
    Time & API Arguments Status Return Repeated

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0
    Time & API Arguments Status Return Repeated

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003590b8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00359178
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00359178
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0
    Time & API Arguments Status Return Repeated

    GlobalMemoryStatusEx

    		 1 1 0
    Time & API Arguments Status Return Repeated

    __exception__

    		 stacktrace: 
    CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x6fd51194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x6fc22ba1
0xb0a384
0xb0a137
0xb039c6
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x6fcf0f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737
mscorlib+0x2d3711 @ 0x6eeb3711
mscorlib+0x308f2d @ 0x6eee8f2d
mscorlib+0x2cb060 @ 0x6eeab060
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737
mscorlib+0x2d36ad @ 0x6eeb36ad
mscorlib+0x308f2d @ 0x6eee8f2d
microsoft+0x50c17 @ 0x72050c17
microsoft+0x3f05f @ 0x7203f05f
microsoft+0x3e4d4 @ 0x7203e4d4
microsoft+0x3cda4 @ 0x7203cda4
0xb02cc3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x6fc21838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x6fc21737
mscorlib+0x2d36ad @ 0x6eeb36ad
mscorlib+0x308f2d @ 0x6eee8f2d
mscorlib+0x3135ed @ 0x6eef35ed
mscorlib+0x9873b1 @ 0x6f5673b1
0xb02815
0xb01f00
0xb01752
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x6fbc70df
LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x6fc1412e
mscorlib+0x2f1c22 @ 0x6eed1c22
mscorlib+0x2f1b99 @ 0x6eed1b99
mscorlib+0x30e9a6 @ 0x6eeee9a6
0xb01303
0xb00fd4
0xb00c1c
microsoft+0x129ed1 @ 0x72129ed1
microsoft+0x12ad86 @ 0x7212ad86
microsoft+0x12b191 @ 0x7212b191
0xb000c0
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4

    exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
    exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
    exception.instruction: leave
    exception.module: KERNELBASE.dll
    exception.exception_code: 0xe0434f4e
    exception.offset: 46887
    exception.address: 0x76a7b727
    registers.esp: 1822588
    registers.edi: 0
    registers.eax: 1822588
    registers.ebp: 1822668
    registers.edx: 0
    registers.ebx: 3830888
    registers.esi: 3364608
    registers.ecx: 2510851758
    		1 0 0

    __exception__

    		 stacktrace: 
    0x6f1798
0x6f0fbb
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7387f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

    exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 8b d7
    exception.instruction: mov eax, dword ptr [ecx]
    exception.exception_code: 0xc0000005
    exception.symbol:
    exception.address: 0x6f1c0b
    registers.esp: 2157872
    registers.edi: 2157896
    registers.eax: 0
    registers.ebp: 2157908
    registers.edx: 195
    registers.ebx: 2158164
    registers.esi: 42104528
    registers.ecx: 0
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 2293760
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006f0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x008e0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 4208
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba1000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 4208
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba2000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 1114112
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00ab0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b80000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00512000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00565000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0056b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00567000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b00000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0051a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0055a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00557000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b01000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 327680
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef58000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 65536
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b02000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0051c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b03000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 4208
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x73772000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b04000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 20480
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b05000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b0a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b0b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b0c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00b0d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 4208
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00556000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 1638400
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x008b0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a00000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2060
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6f501000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2060
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6f502000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 1048576
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x005f0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006b0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00492000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x005c5000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x005cb000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x005c7000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x004ac000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x004ad000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006f0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0049a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x004aa000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0
    section {u'size_of_data': u'0x000b2e00', u'virtual_address': u'0x00002000', u'entropy': 7.861586303006193, u'name': u'.text', u'virtual_size': u'0x000b2ce4'} entropy 7.86158630301 description A section with a high entropy has been found
    entropy 0.816314888762 description Overall entropy of this PE file is high
    Time & API Arguments Status Return Repeated

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeDebugPrivilege
    		1 1 0
    description Listen for incoming communication rule network_tcp_listen
    description Communications smtp rule network_smtp_dotNet
    description Run a keylogger rule keylogger
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    description Bypass DEP rule disable_dep
    description Affect hook table rule win_hook
    host 172.217.25.14
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 245760
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000258
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtQuerySystemInformation

    		 information_class: 8 (SystemProcessorPerformanceInformation)
    		1 0 0
    description mbena.exe tried to sleep 5456442 seconds, actually delayed analysis time by 5456442 seconds
    Time & API Arguments Status Return Repeated

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:  €8€P€h€€ €”8ƒê”4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe(LegalCopyright hOriginalFilenameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
    base_address: 0x00438000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: p À5
    base_address: 0x0043a000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0
    Time & API Arguments Status Return Repeated

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0
    Elastic malicious (high confidence)
    Cylance Unsafe
    Sangfor Trojan.Win32.Save.a
    Symantec Scr.Malcode!gdn34
    APEX Malicious
    FireEye Generic.mg.e81cc62679b5e5aa
    Sophos ML/PE-A
    Ikarus Trojan.Inject
    eGambit Unsafe.AI_Score_84%
    Microsoft Trojan:Win32/Wacatac.B!ml
    Cynet Malicious (score: 100)
    BitDefenderTheta Gen:NN.ZemsilF.34628.2m0@a8lSPim
    ESET-NOD32 a variant of MSIL/Kryptik.AAAV
    SentinelOne Static AI - Malicious PE
    MaxSecure Trojan.Malware.300983.susgen
    Fortinet MSIL/Kryptik.AABO!tr
    Cybereason malicious.92794c
    Qihoo-360 HEUR/QVM03.0.FC85.Malware.Gen
    Process injection Process 4208 called NtSetContextThread to modify thread in remote process 2060
    Time & API Arguments Status Return Repeated

    NtSetContextThread

    		 registers.eip: 0
    registers.esp: 0
    registers.edi: 0
    registers.eax: 4421054
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000254
    process_identifier: 2060
    		1 0 0
    Process injection Process 4208 resumed a thread in remote process 2060
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x00000254
    suspend_count: 1
    process_identifier: 2060
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000014c
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000190
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000024c
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e0
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e0
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000e0
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e0
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e0
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e0
    		1 0 0

    NtSetContextThread

    		 registers.eip: 1874996100
    registers.esp: 1822796
    registers.edi: 1822896
    registers.eax: 11
    registers.ebp: 1822924
    registers.edx: 61900944
    registers.ebx: 1823408
    registers.esi: 61679728
    registers.ecx: 17
    thread_handle: 0x000000e0
    process_identifier: 4208
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000e0
    suspend_count: 1
    process_identifier: 4208
    		1 0 0

    CreateProcessInternalW

    		 thread_identifier: 6596
    thread_handle: 0x00000254
    process_identifier: 2060
    current_directory:
    filepath: C:\Users\test22\AppData\Local\Temp\mbena.exe
    track: 1
    command_line:
    filepath_r: C:\Users\test22\AppData\Local\Temp\mbena.exe
    stack_pivoted: 0
    creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
    inherit_handles: 0
    process_handle: 0x00000258
    		1 1 0

    NtGetContextThread

    		 thread_handle: 0x00000254
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2060
    region_size: 245760
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000258
    		1 0 0

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:
    base_address: 0x00402000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:  €8€P€h€€ €”8ƒê”4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe(LegalCopyright hOriginalFilenameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
    base_address: 0x00438000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: p À5
    base_address: 0x0043a000
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 2060
    process_handle: 0x00000258
    		1 1 0

    NtSetContextThread

    		 registers.eip: 0
    registers.esp: 0
    registers.edi: 0
    registers.eax: 4421054
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000254
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000254
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000154
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000198
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000314
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000334
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000398
    suspend_count: 1
    process_identifier: 2060
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000410
    suspend_count: 1
    process_identifier: 2060
    		1 0 0