Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 31, 2021, 10:22 a.m.	March 31, 2021, 10:24 a.m.

Size	621.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`46bb7c8edade2a3cafb4e69bf3c64bcd`
SHA256	`c8510031a868ab8ef2b11a4261d2aba8c9be252294780faea012bfa94c6d0c70`
CRC32	`6AECF67A`
ssdeep	`12288:m4PBwrTaTpdCylMI8K+iWiifZ1lb2aObp9FP40C2g1BJ0duLjIfuAuxWRxWTHpyl:Cq3xW+cgidFw`
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE64 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

eg5rert2.exe "C:\Users\test22\AppData\Local\Temp\eg5rert2.exe"
2232

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 31, 2021, 10:22 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 31551184 registers.r15: 32464356 registers.rcx: 1998486160 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1998486160 registers.rsp: 3074680 registers.r11: 1999397528 registers.r8: 64 registers.r9: 3074888 registers.rdx: 64 registers.r12: 32472046 registers.rbp: 3074944 registers.rdi: 31391808 registers.rax: 0 registers.r13: 64	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 132 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 region_size: 212992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ed5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e52000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ec9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e5c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e51000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e49000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e62000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e57000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e61000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ea2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076eb0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ecf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e41000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e42000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e4a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e59000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 31, 2021, 10:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e8a000 process_handle: 0xffffffffffffffff	1

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

FireEye	Generic.mg.46bb7c8edade2a3c
Cylance	Unsafe
Cybereason	malicious.4c36c1
APEX	Malicious
Microsoft	Trojan:Win32/Cobaltstrike!ml

eg5rert2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All