Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 22, 2021, 5:48 p.m.	March 22, 2021, 5:55 p.m.

Size	42.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9a89cd0ae20bb7dbd18ae8343f6f933b`
SHA256	`d3498ed58b0cca11c0b3fdd6bf8a83262dfd76871cb4a457e618c113d0f75da3`
CRC32	`E96D9972`
ssdeep	`768:d+TT1UdO9Xtz9avlTEOOW5c7vwoNDCZBToKwqfS2n01X:d+TGdO9XuNT1Oac7vwoZAoKXf8`
Yara	RedLine_Stealer_Zero - RedLine stealer PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Looseboxes.exe "C:\Users\test22\AppData\Local\Temp\Looseboxes.exe"
3236
- AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  7072

Name	Response	Post-Analysis Lookup
mi.himerg.ru	A 81.177.140.11	81.177.140.11

IP Address	Status	Action
147.78.67.95	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
81.177.140.11	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49806 -> 81.177.140.11:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49806 81.177.140.11:443	C=US, O=Let's Encrypt, CN=R3	CN=*.mi.himerg.ru	1e:19:4d:06:72:f2:89:86:82:0e:b4:50:1e:8c:33:f3:2a:94:60:84

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 22, 2021, 5:42 p.m.			0	0
IsDebuggerPresent March 22, 2021, 5:42 p.m.			0	0
IsDebuggerPresent March 22, 2021, 5:42 p.m.			0	0
IsDebuggerPresent March 22, 2021, 5:42 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00460b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00460c10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00460c10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc1e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc328 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 22, 2021, 5:42 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008dc4e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 22, 2021, 5:42 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 22, 2021, 5:42 p.m.	stacktrace: DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 8b 4d e8 e8 41 4e fd exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6e0086 registers.esp: 3993824 registers.edi: 3993872 registers.eax: 5321680 registers.ebp: 3993848 registers.edx: 3 registers.ebx: 3994020 registers.esi: 0 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 22, 2021, 5:42 p.m.

stacktrace:

DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 8b 4d e8 e8 41 4e fd
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6e0086
registers.esp: 3993824
registers.edi: 3993872
registers.eax: 5321680
registers.ebp: 3993848
registers.edx: 3
registers.ebx: 3994020
registers.esi: 0
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://mi.himerg.ru/SystemNetSafeCloseSocketAndEventk

Performs some HTTP requests (1 event)

request

GET https://mi.himerg.ru/SystemNetSafeCloseSocketAndEventk

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

mi.himerg.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 58 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00402000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00535000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00527000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00526000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0097f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f502000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cbf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00438000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 22, 2021, 5:42 p.m.	flags: 15 family: 0		111	0

Yara rule detected in process memory (12 events)

description	Listen for incoming communication	rule	network_tcp_listen
description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Detection of Virtual Appliances through the use of WMI for use of evasion.	rule	WMI_VM_Detect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (2 events)

host	147.78.67.95
host	172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001fc	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 22, 2021, 5:42 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÚVà0@> `@ @0>O`Ì> H.textP> @ `.rsrcÌ`D@@.relocL@B base_address: 0x00400000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: P8hÌ`<<4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfox000004b0,FileDescription 0FileVersion0.0.0.04 InternalNameDraff.exe(LegalCopyright < OriginalFilenameDraff.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0Übêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00426000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: 0> base_address: 0x00428000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7072 process_handle: 0x000001fc	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÚVà0@> `@ @0>O`Ì> H.textP> @ `.rsrcÌ`D@@.relocL@B base_address: 0x00400000 process_identifier: 7072 process_handle: 0x000001fc	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3236 called NtSetContextThread to modify thread in remote process 7072
NtSetContextThread March 22, 2021, 5:42 p.m.	registers.eip: 2000355780 registers.esp: 3144812 registers.edi: 0 registers.eax: 4341378 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 7072	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3236 resumed a thread in remote process 7072
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 7072	1	0	0

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 3236	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 3236	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 3236	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x0000034c suspend_count: 1 process_identifier: 3236	1	0
CreateProcessInternalW March 22, 2021, 5:42 p.m.	thread_identifier: 6012 thread_handle: 0x000001f8 process_identifier: 7072 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x000001fc	1	1
NtUnmapViewOfSection March 22, 2021, 5:42 p.m.	base_address: 0x00400000 region_size: 16121856 process_identifier: 7072 process_handle: 0x000001fc		3221225497
NtAllocateVirtualMemory March 22, 2021, 5:42 p.m.	process_identifier: 7072 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001fc	1	0
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÚVà0@> `@ @0>O`Ì> H.textP> @ `.rsrcÌ`D@@.relocL@B base_address: 0x00400000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: base_address: 0x00402000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: P8hÌ`<<4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfox000004b0,FileDescription 0FileVersion0.0.0.04 InternalNameDraff.exe(LegalCopyright < OriginalFilenameDraff.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0Übêï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00426000 process_identifier: 7072 process_handle: 0x000001fc	1	1
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: 0> base_address: 0x00428000 process_identifier: 7072 process_handle: 0x000001fc	1	1
NtGetContextThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000001f8	1	0
WriteProcessMemory March 22, 2021, 5:42 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 7072 process_handle: 0x000001fc	1	1
NtSetContextThread March 22, 2021, 5:42 p.m.	registers.eip: 2000355780 registers.esp: 3144812 registers.edi: 0 registers.eax: 4341378 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001f8 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:42 p.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 7072	1	0
NtResumeThread March 22, 2021, 5:43 p.m.	thread_handle: 0x000003a8 suspend_count: 1 process_identifier: 7072	1	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.Inject4.8747
MicroWorld-eScan	Trojan.GenericKDZ.73507
CAT-QuickHeal	TrojanDownloader.MSIL
McAfee	GenericRXNY-OW!9A89CD0AE20B
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005792ef1 )
Alibaba	TrojanDownloader:MSIL/Seraph.ed4c8ede
K7GW	Trojan-Downloader ( 005792ef1 )
Arcabit	Trojan.Generic.D11F23
BitDefenderTheta	Gen:NN.ZemsilF.34628.cm0@ay24cig
Cyren	W32/MSIL_Troj.AJR.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HON
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Malware.Filerepmalware-9841599-0
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Trojan.GenericKDZ.73507
NANO-Antivirus	Trojan.Win32.Seraph.ipksrt
AegisLab	Trojan.MSIL.Seraph.a!c
Tencent	Msil.Trojan-downloader.Agent.Hvjd
Ad-Aware	Trojan.GenericKDZ.73507
Sophos	Mal/Generic-S
McAfee-GW-Edition	GenericRXNY-OW!9A89CD0AE20B
FireEye	Trojan.GenericKDZ.73507
Emsisoft	Trojan.GenericKDZ.73507 (B)
Ikarus	Trojan-Downloader.MSIL.Agent
Avira	TR/Dldr.Agent.hrkgi
MAX	malware (ai score=89)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Ymacco.AAD3
GData	Trojan.GenericKDZ.73507
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.GenericKDZ.C4382967
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.GenericKDZ.73507
Malwarebytes	Spyware.RedLineStealer
TrendMicro-HouseCall	TROJ_GEN.R002H0CCH21
Rising	Downloader.Agent!8.B23 (CLOUD)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.74570710.susgen
Fortinet	MSIL/Small.CKP!tr.dldr
Webroot	W32.Trojan.Gen
AVG	Win32:DropperX-gen [Drp]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/TrojanDropper.Generic.HgIASQ8A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (39 events)

dead_host	192.168.56.102:49812
dead_host	192.168.56.102:49827
dead_host	192.168.56.102:49845
dead_host	192.168.56.102:49836
dead_host	192.168.56.102:49816
dead_host	192.168.56.102:49831
dead_host	192.168.56.102:49811
dead_host	192.168.56.102:49840
dead_host	192.168.56.102:49820
dead_host	192.168.56.102:49835
dead_host	147.78.67.95:36331
dead_host	192.168.56.102:49815
dead_host	192.168.56.102:49826
dead_host	192.168.56.102:49839
dead_host	192.168.56.102:49819
dead_host	192.168.56.102:49830
dead_host	192.168.56.102:49848
dead_host	192.168.56.102:49843
dead_host	192.168.56.102:49834
dead_host	192.168.56.102:49852
dead_host	192.168.56.102:49814
dead_host	192.168.56.102:49847
dead_host	192.168.56.102:49838
dead_host	192.168.56.102:49825
dead_host	192.168.56.102:49851
dead_host	192.168.56.102:49842
dead_host	192.168.56.102:49822
dead_host	192.168.56.102:49829
dead_host	192.168.56.102:49846
dead_host	192.168.56.102:49833
dead_host	192.168.56.102:49813
dead_host	192.168.56.102:49824
dead_host	192.168.56.102:49850
dead_host	192.168.56.102:49837
dead_host	192.168.56.102:49817
dead_host	192.168.56.102:49828
dead_host	192.168.56.102:49841
dead_host	192.168.56.102:49821
dead_host	192.168.56.102:49832

Looseboxes.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All