Summary

558911b409182e85_369651ad21d94fd4816c7808d9ea444d.exe

File 558911b409182e85_369651ad21d94fd4816c7808d9ea444d.exe

Summary
Download Resubmit sample

Size 434.5KB
Type PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 366bc8c2b28906606391efe83ffa651e
SHA1 51fc935930f44ab0fcc02b662b40e2806731b9a3
SHA256 558911b409182e85c7dd39373001e65451ea05b197d0f98fc42ed1cc6c93eaed
SHA512
16ec1b11f02d0d65d1321dc583bd03e1671237172b3b9e4f612ab9e2accb44dc1caa4648e8e81f27d02d0c655dd65f36265a52fb2d2c2b768cfedc3502c73a36
CRC32 8A758D9F
ssdeep None
Yara None matched

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6938232

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Sept. 2, 2025, 3:29 p.m. Sept. 2, 2025, 3:36 p.m. 476 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-08-31 21:28:00,000 [analyzer] DEBUG: Starting analyzer from: C:\tmptpreht
2025-08-31 21:28:00,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\oDAdQJQojyLCkWOhfDhVaADDOP
2025-08-31 21:28:00,000 [analyzer] DEBUG: Log pipe server name: \??\PIPE\pBUuASCNvCwFajYqLuVvF
2025-08-31 21:28:00,000 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-08-31 21:28:00,000 [analyzer] INFO: Automatically selected analysis package "exe"
2025-08-31 21:28:00,280 [analyzer] DEBUG: Started auxiliary module Curtain
2025-08-31 21:28:00,280 [analyzer] DEBUG: Started auxiliary module DbgView
2025-08-31 21:28:00,953 [analyzer] DEBUG: Started auxiliary module Disguise
2025-08-31 21:28:01,155 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-08-31 21:28:01,155 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-08-31 21:28:01,155 [analyzer] DEBUG: Started auxiliary module Human
2025-08-31 21:28:01,155 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-08-31 21:28:01,155 [analyzer] DEBUG: Started auxiliary module Reboot
2025-08-31 21:28:01,217 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-08-31 21:28:01,217 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-08-31 21:28:01,233 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-08-31 21:28:01,233 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-08-31 21:28:01,375 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\558911b409182e85_369651ad21d94fd4816c7808d9ea444d.exe' with arguments '' and pid 2216
2025-08-31 21:28:01,640 [analyzer] DEBUG: Loaded monitor into process with pid 2216
2025-08-31 21:28:23,108 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\Local\Temp\c13fdf095eb8490ea60cc1ecbce4a777.exe
2025-08-31 21:29:00,625 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14232B434CF29D4C4FB335A86D7FFFE3
2025-08-31 21:29:00,640 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14232B434CF29D4C4FB335A86D7FFFE3
2025-08-31 21:29:01,937 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\Local\Temp\CabB6CD.tmp
2025-08-31 21:29:02,625 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\Local\Temp\TarB78A.tmp
2025-08-31 21:29:09,687 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-08-31 21:29:09,703 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-08-31 21:29:10,608 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\Local\Temp\CabD8DE.tmp
2025-08-31 21:29:11,155 [analyzer] INFO: Added new file to list with pid 2216 and path C:\Users\Administrator\AppData\Local\Temp\TarD98B.tmp
2025-08-31 21:29:48,703 [analyzer] INFO: Injected into process with pid 2508 and name ''
2025-08-31 21:29:48,983 [analyzer] DEBUG: Loaded monitor into process with pid 2508
2025-08-31 21:29:49,375 [analyzer] INFO: Process with pid 2216 has terminated
2025-08-31 21:30:07,203 [analyzer] INFO: Added new file to list with pid 2508 and path C:\Users\Administrator\AppData\Local\Temp\9bf5768e048d42cb88c72fb809115932.exe
2025-08-31 21:31:20,375 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-08-31 21:31:22,187 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-08-31 21:31:22,203 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-09-02 15:29:00,425 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:01,450 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:02,467 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:03,488 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:04,510 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:05,531 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:06,561 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:07,579 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:08,596 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:09,613 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:10,628 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:11,646 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:12,669 [cuckoo.core.scheduler] DEBUG: Task #6951767: no machine available yet
2025-09-02 15:29:13,842 [cuckoo.core.scheduler] INFO: Task #6951767: acquired machine win7x641 (label=win7x641)
2025-09-02 15:29:13,845 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.201 for task #6951767
2025-09-02 15:29:14,156 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2234308 (interface=vboxnet0, host=192.168.168.201)
2025-09-02 15:29:15,325 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x641
2025-09-02 15:29:16,129 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x641 to vmcloak
2025-09-02 15:31:43,147 [cuckoo.core.guest] INFO: Starting analysis #6951767 on guest (id=win7x641, ip=192.168.168.201)
2025-09-02 15:31:44,153 [cuckoo.core.guest] DEBUG: win7x641: not ready yet
2025-09-02 15:31:49,174 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x641, ip=192.168.168.201)
2025-09-02 15:31:49,269 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x641, ip=192.168.168.201, monitor=latest, size=6660546)
2025-09-02 15:31:50,486 [cuckoo.core.resultserver] DEBUG: Task #6951767: live log analysis.log initialized.
2025-09-02 15:31:51,594 [cuckoo.core.resultserver] DEBUG: Task #6951767 is sending a BSON stream
2025-09-02 15:31:52,001 [cuckoo.core.resultserver] DEBUG: Task #6951767 is sending a BSON stream
2025-09-02 15:31:52,844 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'shots/0001.jpg'
2025-09-02 15:31:52,877 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 118000
2025-09-02 15:32:05,309 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:32:20,453 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:32:35,532 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:32:50,741 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:32:53,819 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/d12dd18018f984aa_CabB6CD.tmp'
2025-09-02 15:32:53,838 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 58383
2025-09-02 15:32:53,930 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/78eeb661b72a34ca_TarB78A.tmp'
2025-09-02 15:32:53,936 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 146584
2025-09-02 15:33:02,264 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/33ba8221ff3f5211_CabD8DE.tmp'
2025-09-02 15:33:02,267 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 73211
2025-09-02 15:33:02,377 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/4018ab25d7d15f77_TarD98B.tmp'
2025-09-02 15:33:02,382 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 189652
2025-09-02 15:33:05,826 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:33:20,914 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:33:36,051 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:33:39,345 [cuckoo.core.resultserver] DEBUG: Task #6951767 is sending a BSON stream
2025-09-02 15:33:40,112 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'shots/0002.jpg'
2025-09-02 15:33:40,126 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 116618
2025-09-02 15:33:51,209 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:34:06,290 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:34:21,367 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:34:36,589 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:34:51,799 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:35:04,723 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'shots/0003.jpg'
2025-09-02 15:35:04,737 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 116767
2025-09-02 15:35:06,887 [cuckoo.core.guest] DEBUG: win7x641: analysis #6951767 still processing
2025-09-02 15:35:07,868 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'shots/0004.jpg'
2025-09-02 15:35:07,879 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 112439
2025-09-02 15:35:11,002 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'shots/0005.jpg'
2025-09-02 15:35:11,005 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'curtain/1756668680.48.curtain.log'
2025-09-02 15:35:11,008 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 36
2025-09-02 15:35:11,020 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 112462
2025-09-02 15:35:12,501 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'sysmon/1756668682.0.sysmon.xml'
2025-09-02 15:35:12,686 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 22554110
2025-09-02 15:35:12,741 [cuckoo.core.resultserver] DEBUG: Task #6951767 had connection reset for <Context for LOG>
2025-09-02 15:35:12,748 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/66e392f0a47b0d49_c13fdf095eb8490ea60cc1ecbce4a777.exe'
2025-09-02 15:35:12,766 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/ebd41040e4bb3ec7_14232b434cf29d4c4fb335a86d7fffe3'
2025-09-02 15:35:12,768 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 889
2025-09-02 15:35:12,769 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/50213f42a80975fd_94308059b57b3142e455b38a6eb92015'
2025-09-02 15:35:12,771 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 344
2025-09-02 15:35:12,772 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/e9fb5371cab149e2_9bf5768e048d42cb88c72fb809115932.exe'
2025-09-02 15:35:12,774 [cuckoo.core.resultserver] DEBUG: Task #6951767: File upload for 'files/87a44f4a7a25746f_14232b434cf29d4c4fb335a86d7fffe3'
2025-09-02 15:35:12,797 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 170
2025-09-02 15:35:12,801 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 445440
2025-09-02 15:35:12,805 [cuckoo.core.resultserver] DEBUG: Task #6951767 uploaded file length: 445440
2025-09-02 15:35:12,919 [cuckoo.core.guest] INFO: win7x641: analysis completed successfully
2025-09-02 15:35:12,932 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-02 15:35:12,960 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-02 15:35:13,893 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x641 to path /srv/cuckoo/cwd/storage/analyses/6951767/memory.dmp
2025-09-02 15:35:13,895 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x641
2025-09-02 15:36:56,457 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.201 for task #6951767
2025-09-02 15:36:57,066 [cuckoo.core.scheduler] DEBUG: Released database task #6951767
2025-09-02 15:36:57,086 [cuckoo.core.scheduler] INFO: Task #6951767: analysis procedure completed

Signatures

Allocates read-write-execute memory (usually to unpack itself) (50 out of 199 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef128a000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000001fd0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000020a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be8000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be8000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be8000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be8000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0be9000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9144d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe914fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91526000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91560000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9146b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9144e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9149c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9146d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91561000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91563000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91564000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91565000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91566000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91567000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91568000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91569000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9156f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91570000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Checks if process is being debugged by a debugger (4 events)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Uses Windows APIs to generate a cryptographic key (4 events)
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000005448c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000005448c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000004b65d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000004b65d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem (2 events)
file C:\Users\Administrator\AppData\Local\Temp\c13fdf095eb8490ea60cc1ecbce4a777.exe
file C:\Users\Administrator\AppData\Local\Temp\9bf5768e048d42cb88c72fb809115932.exe
Drops a binary and executes it (2 events)
file C:\Users\Administrator\AppData\Local\Temp\c13fdf095eb8490ea60cc1ecbce4a777.exe
file C:\Users\Administrator\AppData\Local\Temp\9bf5768e048d42cb88c72fb809115932.exe
Drops an executable to the user AppData folder (2 events)
file C:\Users\Administrator\AppData\Local\Temp\c13fdf095eb8490ea60cc1ecbce4a777.exe
file C:\Users\Administrator\AppData\Local\Temp\9bf5768e048d42cb88c72fb809115932.exe
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Attempts to create or modify system certificates (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
File has been identified by 9 AntiVirus engine on IRMA as malicious (9 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Genie.8DN.1116 (Engine A)
Avast Core Security (Linux) Win32:MalwareX-gen [Drp]
eScan Antivirus (Linux) Gen:Variant.Genie.8DN.1116(DB)
ESET Security (Windows) a variant of MSIL/TrojanDownloader.Agent.SEU trojan
Sophos Anti-Virus (Linux) Troj/MSIL-TIM
DrWeb Antivirus (Linux) Trojan.Inject5.63620
Bitdefender Antivirus (Linux) Gen:Variant.Genie.8DN.1116
Kaspersky Standard (Windows) HEUR:Trojan.MSIL.Agent.gen
Emsisoft Commandline Scanner (Windows) Gen:Variant.Genie.8DN.1116 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.