Attempts to repeatedly call a single API many times in order to delay analysis time
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (2912) called API __exception__ 65536 times
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (3056) called API __exception__ 65536 times
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (2468) called API __exception__ 65536 times
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (1320) called API __exception__ 65536 times
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (2604) called API __exception__ 65536 times
- Spam:
- eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe (2268) called API __exception__ 49071 times
Checks for the presence of known devices from debuggers and forensic tools
- File:
- \??\SICE
- File:
- \??\SIWVID
- File:
- \??\NTICE
Checks for the presence of known windows from debuggers and forensic tools
| PID |
API |
Arguments |
| 2536 |
FindWindowA |
- class_name:
- OLLYDBG
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- GBDYLLO
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- pediy06
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- FilemonClass
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- #0
- window_name:
- File Monitor - Sysinternals: www.sysinternals.com
|
| 2536 |
FindWindowA |
- class_name:
- PROCMON_WINDOW_CLASS
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- #0
- window_name:
- Process Monitor - Sysinternals: www.sysinternals.com
|
| 2536 |
FindWindowA |
- class_name:
- RegmonClass
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- #0
- window_name:
- Registry Monitor - Sysinternals: www.sysinternals.com
|
| 2536 |
FindWindowA |
- class_name:
- 18467-41
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- FilemonClass
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- #0
- window_name:
- File Monitor - Sysinternals: www.sysinternals.com
|
| 2536 |
FindWindowA |
- class_name:
- PROCMON_WINDOW_CLASS
- window_name:
|
| 2536 |
FindWindowA |
- class_name:
- #0
- window_name:
- Process Monitor - Sysinternals: www.sysinternals.com
|
Detects the presence of Wine emulator
- Registry:
- HKEY_CURRENT_USER\Software\Wine
Detects VMWare through the in instruction feature
| PID |
API |
Arguments |
| 2468 |
__exception__ |
- stacktrace:
- []
- exception:
- {u'instruction_r': u'ed 64 8f 05 00 00 00 00 e9 ee 0f 00 00 52 ba 01', u'symbol': u'eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4+0x8793f', u'instruction': u'in eax, dx', u'module': u'eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe', u'exception_code': u'0xc0000096', u'offset': 555327, u'address': u'0x48793f'}
- registers:
- {u'esp': 1638236, u'edi': 9055538, u'eax': 1447909480, u'ebp': 4117737492, u'edx': 22104, u'ebx': 2111312053, u'esi': 4748130, u'ecx': 20}
|
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
| PID |
API |
Arguments |
| 2672 |
GlobalMemoryStatusEx |
N/A |
This sample is detected by clamav as: Win.Malware.Zusy-6622765-0
- Description:
- Win.Malware.Zusy-6622765-0
One or more AV tool detects this sample as malicious: Backdoor:Win32/Xtrat
- Description:
- Backdoor:Win32/Xtrat
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem
- File:
- C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe
Expresses interest in specific running processes
One or more of the buffers contains an embedded PE file
- Buffer:
- Buffer with sha1: 8623dd6de1fb330077e6339f371bef23756ef0cd
- Buffer:
- Buffer with sha1: 437b2e4d5e1ec2dbd72a7ace79ea63e49de39997
Automatic Sequence Detection maliciousness score: 56%
HTTP traffic contains suspicious features which may be indicative of malware related traffic
- Ip Hostname:
- HTTP connection was made to an IP address rather than domain name
- Suspicious Request:
- http://192.168.1.11:777/1234567890.functions
Executed a process and injected code into it, probably while unpacking
| PID |
API |
Arguments |
| 2536 |
CreateProcessInternalW |
- thread_identifier:
- 2676
- thread_handle:
- 0x00000164
- process_identifier:
- 2672
- current_directory:
- filepath:
- C:\Users\Virtual\AppData\Local\Temp\eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe
- track:
- 1
- command_line:
- filepath_r:
- C:\Users\Virtual\AppData\Local\Temp\eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe
- stack_pivoted:
- 0
- creation_flags:
- 4
- process_handle:
- 0x0000016c
- inherit_handles:
- 0
|
| 2536 |
NtUnmapViewOfSection |
- process_handle:
- 0x0000016c
- region_size:
- 2015166464
- process_identifier:
- 2672
- base_address:
- 0x00c80000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2672
- region_size:
- 90112
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0x0000016c
- allocation_type:
- 12288
- base_address:
- 0x00c80000
|
| 2536 |
NtGetContextThread |
- thread_handle:
- 0x00000164
|
| 2536 |
NtSetContextThread |
- registers:
- {u'eip': 2112356804, u'esp': 1638384, u'edi': 0, u'eax': 13191280, u'ebp': 0, u'edx': 0, u'ebx': 2130567168, u'esi': 0, u'ecx': 0}
- thread_handle:
- 0x00000164
- process_identifier:
- 2672
|
| 2536 |
NtResumeThread |
- thread_handle:
- 0x00000164
- suspend_count:
- 1
- process_identifier:
- 2672
|
| 2672 |
CreateProcessInternalW |
- thread_identifier:
- 2724
- thread_handle:
- 0x000000d8
- process_identifier:
- 2720
- current_directory:
- filepath:
- track:
- 1
- command_line:
- calc.exe
- filepath_r:
- stack_pivoted:
- 0
- creation_flags:
- 4
- process_handle:
- 0x00000120
- inherit_handles:
- 0
|
| 2672 |
NtAllocateVirtualMemory |
- process_identifier:
- 2720
- region_size:
- 90112
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0x00000120
- allocation_type:
- 12288
- base_address:
- 0x00c80000
|
| 2672 |
WriteProcessMemory |
- buffer:
- process_handle:
- 0x00000120
- process_identifier:
- 2720
- base_address:
- 0x00c80000
|
Sample contacts servers at uncommon ports
- Connection:
- 192.168.1.11:777
- Registration:
- Registration of port 777 reported as Unregistered
The executable has PE anomalies (could be a false positive)
- Section:
- \x00
- Section:
- .idata
- Section:
-
- Section:
- nhgxrnnn
- Section:
- zgwhklkc
The binary likely contains encrypted or compressed data.
- Section:
- \x00 , at virtual address 0x00001000
- Entropy:
- 7.95973685056
- Description:
- A section with a high entropy has been found
- Section:
- .rsrc, at virtual address 0x00033000
- Entropy:
- 7.52345432813
- Description:
- A section with a high entropy has been found
- Section:
- nhgxrnnn, at virtual address 0x0012e000
- Entropy:
- 7.86137014116
- Description:
- A section with a high entropy has been found
- Entropy:
- 0.987124463519
- Description:
- Overall entropy of this PE file is high
Allocates read-write-execute memory (usually to unpack itself)
| PID |
API |
Arguments |
| 2536 |
NtProtectVirtualMemory |
- process_identifier:
- 2536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 8192
- protection:
- 64
- process_handle:
- 0xffffffff
- base_address:
- 0x7df0f000
|
| 2536 |
NtProtectVirtualMemory |
- process_identifier:
- 2536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 8192
- protection:
- 64
- process_handle:
- 0xffffffff
- base_address:
- 0x7de80000
|
| 2536 |
NtProtectVirtualMemory |
- process_identifier:
- 2536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 94208
- protection:
- 64
- process_handle:
- 0xffffffff
- base_address:
- 0x00401000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x040a0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x040b0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 8192
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x040c0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 65536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04190000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x046b0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x046c0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x046d0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x046e0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x046f0000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04700000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04710000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04720000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 8192
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04730000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04740000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04750000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04760000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2536
- region_size:
- 4096
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0xffffffff
- allocation_type:
- 4096
- base_address:
- 0x04770000
|
| 2536 |
NtAllocateVirtualMemory |
- process_identifier:
- 2672
- region_size:
- 90112
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0x0000016c
- allocation_type:
- 12288
- base_address:
- 0x00c80000
|
| 2672 |
NtProtectVirtualMemory |
- process_identifier:
- 2672
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 1
- length:
- 4096
- protection:
- 64
- process_handle:
- 0xffffffff
- base_address:
- 0x00c80000
|
| 2672 |
NtAllocateVirtualMemory |
- process_identifier:
- 2720
- region_size:
- 90112
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- process_handle:
- 0x00000120
- allocation_type:
- 12288
- base_address:
- 0x00c80000
|
Creates a slightly modified copy of itself
The following process appear to have been packed with Themida: eea79b7dcdbcb684d1900d7ce9eb485edd4e741abfb0858c47176645afe8b0a4.exe
Installs itself for autorun at Windows startup
- File:
- C:\Users\Virtual\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe
Contains obfuscated control-flow to defeat static analysis.
Creates known XtremeRAT mutexes
Creates known XtremeRAT files, registry keys or mutexes
- Regkey:
- HKEY_CURRENT_USER\SOFTWARE\XtremeRAT
This sample contains high entropy sections
- Section:
- \x00 , at virtual address 0x00001000
- Entropy:
- 7.95973685056
- Section:
- .rsrc, at virtual address 0x00033000
- Entropy:
- 7.52345432813
- Section:
- nhgxrnnn, at virtual address 0x0012e000
- Entropy:
- 7.86137014116
This sample contains low entropy sections
- Section:
- .idata , at virtual address 0x0003a000
- Entropy:
- 0.220958014954
- Section:
- , at virtual address 0x0003b000
- Entropy:
- 0.0421692483801
- Section:
- zgwhklkc, at virtual address 0x001f9000
- Entropy:
- 0.712098118577
Anomalous binary characteristics
- Anomaly:
- Unprintable characters found in section name
- Anomaly:
- Actual checksum does not match that reported in PE header
