popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

random.exe

Gen1 Generic Malware PhysicalDrive Themida UPX Malicious Library Malicious Packer Downloader Antivirus HTTP ScreenShot Create Service KeyLogger Internet API DGA Http API FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 28, 2025, 10:09 a.m. April 28, 2025, 10:11 a.m.
Size 2.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bfd4ad6d57c086d2e64ccd39398a908e
SHA256 e2aef88dd7c7eaf85319f9d99ed0e95598d356d4549a6f73dba6a62c77487937
CRC32 F66B3316
ssdeep 49152:nz6llBaWntTd/8ZSgTj9Tpc8iYM9+SFBWFuLiCJ53aUHifaNshTPWl6wIlw:qlBaWNpUSgT5TFMsFALiCrqUHzNshKlb
Yara
  • themida_packer - themida packer
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "" /min "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: exit
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /b
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "any_word" == ""
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "" /min "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: exit
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /b
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: chcp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: nul
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Color
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 0f
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "Arch="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "ArgNsudo="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "MainFolder1="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "MainFolder2="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "ProcList="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "NumberWin="
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SetLocal
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: EnableDelayedExpansion
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: cd
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /d "C:\Users\test22\AppData\Local\Temp\Work"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\Work>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "Arch=x64"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: If
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: "x86" == "x86"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: not
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: defined PROCESSOR_ARCHITEW6432
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Arch=x86
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\Work>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: reg
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751396
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751424
registers.edx: 0
registers.ebx: 13972400
registers.esi: 6
registers.ecx: 13972400
1 0 0

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751396
registers.edi: 2751396
registers.eax: 0
registers.ebp: 2751424
registers.edx: 0
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751604
1 0 0

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751396
registers.edi: 2751396
registers.eax: 0
registers.ebp: 2751424
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751604
1 0 0

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751396
registers.edi: 2751396
registers.eax: 0
registers.ebp: 2751424
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751604
1 0 0

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751396
registers.edi: 2751396
registers.eax: 0
registers.ebp: 2751424
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751604
1 0 0

__exception__

 stacktrace: 
random+0x1bd22b @ 0x136d22b
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751396
registers.edi: 2751396
registers.eax: 0
registers.ebp: 2751424
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751604
1 0 0

__exception__

 stacktrace: 
random+0x1bc520 @ 0x136c520
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 14802944
registers.esi: 18997248
registers.ecx: 18997248
1 0 0

__exception__

 stacktrace: 
random+0x1bc520 @ 0x136c520
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc520 @ 0x136c520
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc520 @ 0x136c520
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 14802944
registers.esi: 18997248
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc5fc @ 0x136c5fc
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc6ce @ 0x136c6ce
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 14802944
registers.esi: 18997248
registers.ecx: 2751376
1 0 0

__exception__

 stacktrace: 
random+0x1bc6ce @ 0x136c6ce
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc7c8 @ 0x136c7c8
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 14802944
registers.esi: 18997248
registers.ecx: 2281060190
1 0 0

__exception__

 stacktrace: 
random+0x1bc7c8 @ 0x136c7c8
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc7c8 @ 0x136c7c8
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc7c8 @ 0x136c7c8
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 20332684
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 14802944
registers.esi: 18997248
registers.ecx: 3281325915
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x124204
exception.instruction: ud2
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 1196548
exception.address: 0x12d4204
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 2
registers.ebx: 19743215
registers.esi: 0
registers.ecx: 2751384
1 0 0

__exception__

 stacktrace: 
random+0x1bc85e @ 0x136c85e
random+0x1bf81f @ 0x136f81f
random+0x1478dc @ 0x12f78dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: random+0x1241d9
exception.instruction: div eax
exception.module: random.exe
exception.exception_code: 0xc0000094
exception.offset: 1196505
exception.address: 0x12d41d9
registers.esp: 2751348
registers.edi: 2751348
registers.eax: 0
registers.ebp: 2751376
registers.edx: 0
registers.ebx: 19743258
registers.esi: 0
registers.ecx: 2751384
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 2936832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73332000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\Work\nircmd.exe
file C:\Users\test22\AppData\Local\Temp\Work\NSudoLG.exe
file C:\Users\test22\AppData\Local\Temp\Work\7z.exe
file C:\Users\test22\AppData\Local\Temp\34.bat
file C:\Users\test22\AppData\Local\Temp\24.bat
file C:\Users\test22\AppData\Local\Temp\Work\cecho.exe
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
cmdline "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\34.bat" any_word
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
cmdline C:\Windows\system32\cmd.exe /c ver
cmdline schtasks /Delete /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /f
cmdline C:\Windows\system32\cmd.exe /S /D /c" ver "
cmdline C:\Windows\system32\cmd.exe /c tasklist
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
file C:\Users\test22\AppData\Local\Temp\34.bat
file C:\Users\test22\AppData\Local\Temp\Work\NSudoLG.exe
file C:\Users\test22\AppData\Local\Temp\Work\cecho.exe
file C:\Users\test22\AppData\Local\Temp\Work\7z.exe
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
section {u'size_of_data': u'0x0001be00', u'virtual_address': u'0x00001000', u'entropy': 7.996205637989911, u'name': u'', u'virtual_size': u'0x00032000'} entropy 7.99620563799 description A section with a high entropy has been found
section {u'size_of_data': u'0x00004800', u'virtual_address': u'0x00033000', u'entropy': 7.973325024284936, u'name': u'', u'virtual_size': u'0x0000b000'} entropy 7.97332502428 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000800', u'virtual_address': u'0x0003e000', u'entropy': 7.4688141552761795, u'name': u'', u'virtual_size': u'0x00025000'} entropy 7.46881415528 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x00064000', u'entropy': 7.764550992600053, u'name': u'', u'virtual_size': u'0x00005000'} entropy 7.7645509926 description A section with a high entropy has been found
section {u'size_of_data': u'0x00098200', u'virtual_address': u'0x0036b000', u'entropy': 7.936454714357046, u'name': u'.data', u'virtual_size': u'0x00099000'} entropy 7.93645471436 description A section with a high entropy has been found
entropy 0.989361702128 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
cmdline reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
cmdline sc delete "MsSecCore"
cmdline sc delete "wscsvc"
cmdline reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
cmdline sc config "WdFilter" start= disabled
cmdline sc delete "WinDefend"
cmdline reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
cmdline sc stop "WdFilter"
cmdline reg delete "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderApiLogger" /f
cmdline sc delete "WdNisSvc"
cmdline schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
cmdline sc stop "SgrmAgent"
cmdline NSudoLG -U:T -P:E -UseCurrentConsole C:\Users\test22\AppData\Local\Temp\34.bat
cmdline reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
cmdline C:\Users\test22\AppData\Local\Temp\34.bat
cmdline reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
cmdline tasklist
cmdline sc stop "webthreatdefsvc"
cmdline reg delete "HKLM\Software\Microsoft\SystemSettings\SettingId\SystemSettings_WindowsDefender_UseWindowsDefender" /f
cmdline reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
cmdline sc stop "MsSecWfp"
cmdline reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
cmdline reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
cmdline reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
cmdline reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
cmdline schtasks /Delete /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /f
cmdline sc config "Sense" start= disabled
cmdline reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
cmdline sc delete "WdNisDrv"
cmdline reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
cmdline reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
cmdline reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
cmdline sc config "MsSecCore" start= disabled
cmdline sc config "webthreatdefsvc" start= disabled
cmdline sc delete "WdBoot"
cmdline sc stop "SgrmBroker"
cmdline sc config "WdBoot" start= disabled
cmdline reg query "HKU\S-1-5-19"
cmdline sc config "SgrmAgent" start= disabled
cmdline sc delete "Sense"
cmdline reg delete "HKLM\Software\Microsoft\Windows Advanced Threat Protection" /f
cmdline C:\Windows\system32\cmd.exe /c tasklist
cmdline sc stop "WdBoot"
cmdline reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
cmdline reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" /f
cmdline sc stop "MsSecCore"
cmdline reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
cmdline reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
cmdline sc delete "SecurityHealthService"
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x00000000003272b0
service_name: None
control_code: 1
0 0

ControlService

 service_handle: 0x0000000000257290
service_name: None
control_code: 1
0 0
Process injection Process 2656 resumed a thread in remote process 2724
Process injection Process 2984 resumed a thread in remote process 3068
Process injection Process 3068 resumed a thread in remote process 2104
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2724
1 0 0

NtResumeThread

 thread_handle: 0x000000000000012c
suspend_count: 1
process_identifier: 3068
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000074
suspend_count: 0
process_identifier: 2104
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.vc
ALYac Trojan.Rasftuby.Gen.14
Cylance Unsafe
VIPRE Trojan.Rasftuby.Gen.14
CrowdStrike win/grayware_confidence_60% (D)
BitDefender Trojan.Rasftuby.Gen.14
Arcabit Trojan.Rasftuby.Gen.14
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.Enigma.AAF
APEX Malicious
Avast WAT:Blacked-E
ClamAV Win.Trojan.Scar-6903585-0
Kaspersky HackTool.BAT.DefenderKiller.a
MicroWorld-eScan Trojan.Rasftuby.Gen.14
Emsisoft Trojan.Rasftuby.Gen.14 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Tool.NirCmd.4
McAfeeD ti!E2AEF88DD7C7
Trapmine malicious.high.ml.score
CTX exe.trojan.rasftuby
Sophos Generic ML PUA (PUA)
Avira TR/Dropper.Gen
Microsoft Trojan:Win32/Tnega!ml
GData Trojan.Rasftuby.Gen.14
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Bitrep
Malwarebytes AdRepack.Adware.Packer.DDS
Ikarus Gen.Packer.PESpin
Zoner Probably Heur.ExeHeaderL
Fortinet Riskware/Application
AVG WAT:Blacked-E