Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 31, 2025, 12:07 p.m.	March 31, 2025, 12:24 p.m.

Size	12.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`09f7e5af8af839111c760e5fead1363f`
SHA256	`81e8ba37f175c8798101d49019f24188d0877185e68cbe8b2ad3ca1f0cb89eef`
CRC32	`9D37DC02`
ssdeep	`196608:mzThHKR3CVPLc4F8d+qSicW9mHTPUULixyoWh2FMmq6nQJEx:mlKJADF8dCnToWhROQJEx`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library Admin_Tool_IN_Zero - Admin Tool Sysinternals Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet mzp_file_format - MZP(Delphi) file format IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

nixsudo.exe "C:\Users\test22\AppData\Local\Temp\nixsudo.exe"
2576
- MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2744
- tcpvcon.exe "C:\ProgramData\Fortect\tcpvcon.exe" "C:\ProgramData\Fortect\tcpvcon.exe" /accepteula
  2896

Name	Response	Post-Analysis Lookup
1.56.168.192.in-addr.arpa

IP Address	Status	Action
103.28.89.34	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 31, 2025, 12:07 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 31, 2025, 12:07 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (25 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0
IsDebuggerPresent March 31, 2025, 12:07 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA March 31, 2025, 12:07 p.m.	buffer: Tcpvcon.exe v4.18 - Sysinternals TcpVcon Copyright (C) 1996-2023 Mark Russinovich & Bryce Cogswell Sysinternals - www.sysinternals.com console_handle: 0x0000000b	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 31, 2025, 12:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00f1b528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 31, 2025, 12:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00f1b628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 31, 2025, 12:07 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00f1b628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 31, 2025, 12:07 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.itext
section	.didata

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PSBI

Allocates read-write-execute memory (usually to unpack itself) (50 out of 80 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2576 region_size: 745472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061c000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73381000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72492000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732e2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 38912 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da0400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00efa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00efb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00efc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00efd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00efe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da0178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da01a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da01c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da01f0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05da0218 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 31, 2025, 12:07 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05daa44e process_handle: 0xffffffff		3221225550

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW March 31, 2025, 12:07 p.m.	thread_identifier: 2900 thread_handle: 0x00000184 process_identifier: 2896 current_directory: filepath: track: 1 command_line: "C:\ProgramData\Fortect\tcpvcon.exe" "C:\ProgramData\Fortect\tcpvcon.exe" /accepteula filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000180	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00796a00', u'virtual_address': u'0x00518000', u'entropy': 7.8742817989229765, u'name': u'.rsrc', u'virtual_size': u'0x0079685e'}

entropy

7.87428179892

description

A section with a high entropy has been found

entropy

0.62604737351

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 31, 2025, 12:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 31, 2025, 12:07 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

pw.exe

Communicates with host for which no DNS query was performed (1 event)

host

103.28.89.34

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 31, 2025, 12:07 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

MSBuild.exe tried to sleep 2728189 seconds, actually delayed analysis time by 2728189 seconds

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe\:Zone.Identifier

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress March 31, 2025, 12:07 p.m.	ordinal: 0 function_address: 0x004130d4 function_name: wine_get_version module: ntdll module_address: 0x76f10000		3221225785	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Penguish.4!c
CAT-QuickHeal	Trojan.Ghanarava.1743321197d1363f
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.76131142
Cylance	Unsafe
VIPRE	Trojan.GenericKD.76131142
Sangfor	Trojan.Win32.Penguish.Vpjo
BitDefender	Trojan.GenericKD.76131142
K7GW	Trojan ( 005c47ed1 )
K7AntiVirus	Trojan ( 005c47ed1 )
Arcabit	Trojan.Generic.D489AB46
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.GXLYXZH
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Penguish.eav
MicroWorld-eScan	Trojan.GenericKD.76131142
Rising	Trojan.Penguish!8.18A49 (CLOUD)
Emsisoft	Trojan.GenericKD.76131142 (B)
F-Secure	Trojan.TR/Agent.mvtdq
DrWeb	Trojan.Inject5.19926
Zillya	Trojan.Penguish.Win32.783
TrendMicro	Trojan.Win32.GHOSTSOCKS.YXFC1Z
McAfeeD	ti!81E8BA37F175
CTX	exe.trojan.penguish
Sophos	Mal/Generic-S
FireEye	Trojan.GenericKD.76131142
Google	Detected
Avira	TR/Agent.mvtdq
Antiy-AVL	Trojan/Win32.Penguish
Gridinsoft	Ransom.Win32.Wacatac.cl
Microsoft	Trojan:Win32/Leonem!rfn
GData	Trojan.GenericKD.76131142
Varist	W32/ABTrojan.WXPX-0119
McAfee	Artemis!09F7E5AF8AF8
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.Injector
Ikarus	Trojan.SuspectCRC
Panda	Trj/Agent.MK
TrendMicro-HouseCall	Trojan.Win32.GHOSTSOCKS.YXFC1Z
Tencent	Malware.Win32.Gencirc.1460c0d6
MaxSecure	Trojan.Malware.338319211.susgen
Fortinet	Malicious_Behavior.SB
AVG	Win32:Malware-gen
Paloalto	generic.ml
alibabacloud	Trojan:Win/Penguish.edt

nixsudo.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All