popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mbena.exe

  1. Resubmit sample
    Category Machine Started Completed
    FILE s1_win7_x6402 March 19, 2021, 6:07 p.m. March 19, 2021, 6:09 p.m.
    Size 877.0KB
    Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
    MD5 e81cc62679b5e5aa3291b0168b271ee9
    SHA256 aa128e8000ef9197eed67a5b6f27454e0c1b1878ed7546394fde472d42836eb9
    CRC32 657B1C36
    ssdeep 12288:drj1SX8P9VVigVZNABK/rTR8Wjw8FP+mQ2AItCKfXjNqX9xQjToBfATE5:6XmOgTeBWr9Vl+XfgpI8oBfATE
    Yara
    • PE_Header_Zero - PE File Signature Zero
    • IsPE32 - (no description)
    • IsNET_EXE - (no description)
    • IsWindowsGUI - (no description)
    • IsPacked - Entropy Check
    • Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult

    Name Response Post-Analysis Lookup
    No hosts contacted.
    IP Address Status Action
    172.217.25.14 Active Moloch

    Suricata Alerts

    No Suricata Alerts

    Suricata TLS

    No Suricata TLS

    Time & API Arguments Status Return Repeated

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0
    Time & API Arguments Status Return Repeated

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0
    Time & API Arguments Status Return Repeated

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x004f18d8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x004f1998
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x004f1998
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0
    Time & API Arguments Status Return Repeated

    GlobalMemoryStatusEx

    		 1 1 0
    Time & API Arguments Status Return Repeated

    __exception__

    		 stacktrace: 
    0x691798
0x690fbb
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

    exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc e8 8b d7
    exception.instruction: mov eax, dword ptr [ecx]
    exception.exception_code: 0xc0000005
    exception.symbol:
    exception.address: 0x691c0b
    registers.esp: 3665120
    registers.edi: 3665144
    registers.eax: 0
    registers.ebp: 3665156
    registers.edx: 195
    registers.ebx: 3665404
    registers.esi: 40279396
    registers.ecx: 0
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 1835008
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x008c0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a40000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 6240
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba1000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 6240
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba2000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 1441792
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00740000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00860000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00422000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00455000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0045b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00457000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00750000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0042a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0044a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00447000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00751000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 327680
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef58000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 65536
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00752000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0042c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00753000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 6240
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x73772000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00754000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 20480
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00755000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0075a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0075b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0075c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0075d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 6240
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00446000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 655360
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00440000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x004a0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 5168
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba1000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 5168
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba2000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 851968
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00620000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006b0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003e2000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00455000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0045b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00457000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003fc000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003fd000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00690000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003ea000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003fa000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0
    section {u'size_of_data': u'0x000b2e00', u'virtual_address': u'0x00002000', u'entropy': 7.861586303006193, u'name': u'.text', u'virtual_size': u'0x000b2ce4'} entropy 7.86158630301 description A section with a high entropy has been found
    entropy 0.816314888762 description Overall entropy of this PE file is high
    Time & API Arguments Status Return Repeated

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeDebugPrivilege
    		1 1 0
    url http://go2.microsoft.com/fwlink/?LinkId=131738
    url http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
    url http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0
    url http://microsoft.com0
    url http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
    url http://www.microsoft.com/pkiops/docs/primarycps.htm0
    url http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
    url http://beta.visualstudio.net/net/sdk/feedback.asp
    url http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
    url http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
    url http://www.microsoft.com/PKI/docs/CPS/default.htm0
    url http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
    url http://ns.adobe.com/xap/1.0/
    url http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
    description Listen for incoming communication rule network_tcp_listen
    description Communications smtp rule network_smtp_dotNet
    description Run a keylogger rule keylogger
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    description Bypass DEP rule disable_dep
    description Affect hook table rule win_hook
    description Code injection with CreateRemoteThread in a remote process rule inject_thread
    description Create a windows service rule create_service
    description Create a COM server rule create_com_service
    description Communications over UDP network rule network_udp_sock
    description Listen for incoming communication rule network_tcp_listen
    description Communications smtp rule network_smtp_dotNet
    description Communications over P2P network rule network_p2p_win
    description Communications over HTTP rule network_http
    description File downloader/dropper rule network_dropper
    description Communications over FTP rule network_ftp
    description Communications over RAW socket rule network_tcp_socket
    description Communications use DNS rule network_dns
    description Communication using dga rule network_dga
    description Escalade priviledges rule escalate_priv
    description Take screenshot rule screenshot
    description Run a keylogger rule keylogger
    description Steal credential rule cred_local
    description Record Audio rule sniff_audio
    description APC queue tasks migration rule migrate_apc
    description Malware can spread east-west file rule spreading_file
    description Malware can spread east-west using share drive rule spreading_share
    description Create or check mutex rule win_mutex
    description Affect system registries rule win_registry
    description Affect system token rule win_token
    description Affect private profile rule win_private_profile
    description Affect private profile rule win_files_operation
    description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
    description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
    description Match Windows Inet API call rule Str_Win32_Internet_API
    description Match Windows Http API call rule Str_Win32_Http_API
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerCheck__RemoteAPI
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule DebuggerException__ConsoleCtrl
    description (no description) rule DebuggerException__SetConsoleCtrl
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    Time & API Arguments Status Return Repeated

    NtTerminateProcess

    		 status_code: 0xffffffff
    process_identifier: 6240
    process_handle: 0x0000022c
    		0 0

    NtTerminateProcess

    		 status_code: 0xffffffff
    process_identifier: 6240
    process_handle: 0x0000022c
    		3221225738 0
    host 172.217.25.14
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 245760
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000258
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtQuerySystemInformation

    		 information_class: 8 (SystemProcessorPerformanceInformation)
    		1 0 0
    description mbena.exe tried to sleep 5456440 seconds, actually delayed analysis time by 5456440 seconds
    Time & API Arguments Status Return Repeated

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:  €8€P€h€€ €”8ƒê”4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe(LegalCopyright hOriginalFilenameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
    base_address: 0x00438000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: p À5
    base_address: 0x0043a000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0
    Time & API Arguments Status Return Repeated

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0
    Elastic malicious (high confidence)
    Cylance Unsafe
    Sangfor Trojan.Win32.Save.a
    Symantec Scr.Malcode!gdn34
    APEX Malicious
    FireEye Generic.mg.e81cc62679b5e5aa
    Sophos ML/PE-A
    Ikarus Trojan.Inject
    eGambit Unsafe.AI_Score_84%
    Microsoft Trojan:Win32/Wacatac.B!ml
    Cynet Malicious (score: 100)
    BitDefenderTheta Gen:NN.ZemsilF.34628.2m0@a8lSPim
    ESET-NOD32 a variant of MSIL/Kryptik.AAAV
    SentinelOne Static AI - Malicious PE
    MaxSecure Trojan.Malware.300983.susgen
    Fortinet MSIL/Kryptik.AABO!tr
    Cybereason malicious.92794c
    Qihoo-360 HEUR/QVM03.0.FC85.Malware.Gen
    Process injection Process 6240 called NtSetContextThread to modify thread in remote process 5168
    Time & API Arguments Status Return Repeated

    NtSetContextThread

    		 registers.eip: 0
    registers.esp: 0
    registers.edi: 0
    registers.eax: 4421054
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000254
    process_identifier: 5168
    		1 0 0
    Process injection Process 6240 resumed a thread in remote process 5168
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x00000254
    suspend_count: 1
    process_identifier: 5168
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 6240
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000150
    suspend_count: 1
    process_identifier: 6240
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000001c0
    suspend_count: 1
    process_identifier: 6240
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000024c
    suspend_count: 1
    process_identifier: 6240
    		1 0 0

    CreateProcessInternalW

    		 thread_identifier: 8408
    thread_handle: 0x00000254
    process_identifier: 5168
    current_directory:
    filepath: C:\Users\test22\AppData\Local\Temp\mbena.exe
    track: 1
    command_line:
    filepath_r: C:\Users\test22\AppData\Local\Temp\mbena.exe
    stack_pivoted: 0
    creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
    inherit_handles: 0
    process_handle: 0x00000258
    		1 1 0

    NtGetContextThread

    		 thread_handle: 0x00000254
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 5168
    region_size: 245760
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000258
    		1 0 0

    WriteProcessMemory

    		 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁÐ_à  V¾u @ À@…puK€(   H.textÄU V `.rsrc(€X@@.reloc  ^@B
    base_address: 0x00400000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:
    base_address: 0x00402000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer:  €8€P€h€€ €”8ƒê”4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe(LegalCopyright hOriginalFilenameOlqLPaCSrGtUTIPpGCmIJcZhGm.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
    base_address: 0x00438000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: p À5
    base_address: 0x0043a000
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 5168
    process_handle: 0x00000258
    		1 1 0

    NtSetContextThread

    		 registers.eip: 0
    registers.esp: 0
    registers.edi: 0
    registers.eax: 4421054
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000254
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000254
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000014c
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000001bc
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000031c
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000033c
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000003a0
    suspend_count: 1
    process_identifier: 5168
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000418
    suspend_count: 1
    process_identifier: 5168
    		1 0 0