What is gennt.exe?
gennt.exe is developed by IObit according to the gennt.exe version information.
gennt.exe is usually located in the 'C:\ProgramData\2bd20eaa905c1c6a2d7d\' folder.
Some of the anti-virus scanners at VirusTotal detected gennt.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on gennt.exe:
| Property | Value |
|---|---|
| Company name | IObit |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Company name | IObit |
Digital signatures [?]
The verification of gennt.exe's digital signature failed.
| Property | Value |
|---|---|
| Signer name | LETVTCCVPRDGGWDAJF |
| Certificate issuer name | LETVTCCVPRDGGWDAJF |
| Certificate serial number | 3a5a5e443d423fad44b1c09e226cd7f1 |
VirusTotal report
38 of the 69 anti-virus programs at VirusTotal detected the gennt.exe file. That's a 55% detection rate.
| Scanner | Detection Name |
|---|---|
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Razy.699949 |
| ALYac | Gen:Variant.Razy.699949 |
| Antiy-AVL | GrayWare/Win32.Kryptik.ehls |
| APEX | Malicious |
| Arcabit | Trojan.Razy.DAAE2D |
| Avast | Win32:DangerousSig [Trj] |
| AVG | Win32:DangerousSig [Trj] |
| Avira | TR/AD.BuerLoader.JK |
| BitDefender | Gen:Variant.Razy.699949 |
| BitDefenderTheta | Gen:NN.ZexaF.34144.gm1@aC1XyHib |
| Bkav | W32.AIDetectVM.malware1 |
| CrowdStrike | win/malicious_confidence_80% (D) |
| Cybereason | malicious.db3572 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| eGambit | Unsafe.AI_Score_71% |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Razy.699949 (B) |
| ESET-NOD32 | a variant of Win32/GenKryptik.EMWX |
| F-Secure | Trojan.TR/AD.BuerLoader.JK |
| FireEye | Generic.mg.d7610471691672af |
| Fortinet | W32/GenKryptik.EOOB!tr |
| GData | Win32.Trojan.Kryptik.PY |
| Invincea | heuristic |
| Kaspersky | Trojan-Downloader.Win32.Buerak.pe |
| MAX | malware (ai score=85) |
| McAfee | Drixed-FJQ!D76104716916 |
| Microsoft | Trojan:Win32/Amadey.GM!MTB |
| MicroWorld-eScan | Gen:Variant.Razy.699949 |
| Qihoo-360 | HEUR/QVM20.1.EEC9.Malware.Gen |
| Rising | Malware.Heuristic!ET#99% (RDMK:cmRtazr0mU2ktl6RJpgz6eXo3cz0) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/EncPk-APV |
| Symantec | Packed.Generic.459 |
| VBA32 | Malware-Cryptor.Limpopo |
| ZoneAlarm | Trojan-Downloader.Win32.Buerak.pe |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"directory_created": [
"C:\\ProgramData\\4b82648b808e5d3665ad"
],
"dll_loaded": [
"DNSAPI.dll",
"KERNEL32.dll",
"netapi32.dll",
"ntdll.dll",
"cryptsp.dll",
"winhttp.dll",
"C:\\Windows\\System32\\wship6.dll",
"SspiCli.dll",
"advapi32.dll",
"ole32.dll",
"SHLWAPI.dll",
"credssp.dll",
"cscapi.dll",
"IPHLPAPI.DLL",
"shell32.dll",
"CFGMGR32.dll",
"SHELL32.dll",
"RPCRT4.dll",
"wkscli.dll",
"NSI.dll",
"kernel32.dll",
"C:\\Windows\\system32\\mswsock.dll",
"ADVAPI32.dll",
"rpcrt4.dll",
"C:\\Windows\\System32\\wshtcpip.dll",
"WS2_32.dll",
"user32.dll",
"Winhttp.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"\\\\?\\PIPE\\wkssvc",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"c:\\",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
"HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
"HKEY_CURRENT_USER",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache"
],
"resolves_host": [
"unlimitedvideo.top"
],
"file_written": [
"\\\\?\\PIPE\\wkssvc",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
],
"file_exists": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"file_failed": [
"\\??\\L:",
"\\??\\N:",
"\\??\\U:",
"\\??\\H:",
"\\??\\W:",
"\\??\\J:",
"\\??\\Q:",
"\\??\\D:",
"\\??\\S:",
"\\??\\F:",
"\\??\\B:",
"\\??\\M:",
"\\??\\X:",
"\\??\\Z:",
"\\??\\O:",
"\\??\\I:",
"\\??\\T:",
"\\??\\V:",
"\\??\\K:",
"\\??\\E:",
"\\??\\P:",
"\\??\\R:",
"\\??\\G:",
"\\??\\A:",
"\\??\\Y:"
],
"command_line": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"\\\\?\\PIPE\\wkssvc",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
]
}Dropped
[
{
"yara": [],
"sha1": "2f44eebdb35724e49d7092886e2feb6e5e627cc4",
"name": "becdfa7b36f909e4_becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"type": "PE32 executable (GUI) Intel 80386, for MS Windows",
"sha256": "becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100",
"urls": [
"https:\/\/www.example.com\/my_product\/info.html0"
],
"crc32": "DDBF997E",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8805\/files\/becdfa7b36f909e4_becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"ssdeep": null,
"size": 111168,
"sha512": "ed44f9e93411ee1432c8fc438a2596eb5192cab73d61f7bda5bdd4538ffcdc54df88d73a8a9f7312216df4dcf2ef95ad4b14484c21b39aed3157ee6b5325e180",
"pids": [],
"md5": "d7610471691672af41aec15c4880d60e"
}
]Generic
[
{
"process_path": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe",
"process_name": "gennt.exe",
"pid": 856,
"summary": {
"directory_created": [
"C:\\ProgramData\\4b82648b808e5d3665ad"
],
"dll_loaded": [
"DNSAPI.dll",
"KERNEL32.dll",
"netapi32.dll",
"ntdll.dll",
"cryptsp.dll",
"winhttp.dll",
"C:\\Windows\\System32\\wship6.dll",
"SspiCli.dll",
"advapi32.dll",
"ole32.dll",
"SHLWAPI.dll",
"credssp.dll",
"cscapi.dll",
"IPHLPAPI.DLL",
"shell32.dll",
"CFGMGR32.dll",
"SHELL32.dll",
"RPCRT4.dll",
"wkscli.dll",
"NSI.dll",
"kernel32.dll",
"C:\\Windows\\system32\\mswsock.dll",
"ADVAPI32.dll",
"rpcrt4.dll",
"C:\\Windows\\System32\\wshtcpip.dll",
"WS2_32.dll",
"user32.dll",
"Winhttp.dll"
],
"file_opened": [
"\\\\?\\PIPE\\wkssvc",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"c:\\",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
"HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
"HKEY_CURRENT_USER",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache"
],
"resolves_host": [
"unlimitedvideo.top"
],
"file_written": [
"\\\\?\\PIPE\\wkssvc"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
],
"file_failed": [
"\\??\\L:",
"\\??\\N:",
"\\??\\U:",
"\\??\\H:",
"\\??\\W:",
"\\??\\J:",
"\\??\\Q:",
"\\??\\D:",
"\\??\\S:",
"\\??\\F:",
"\\??\\B:",
"\\??\\M:",
"\\??\\X:",
"\\??\\Z:",
"\\??\\O:",
"\\??\\I:",
"\\??\\T:",
"\\??\\V:",
"\\??\\K:",
"\\??\\E:",
"\\??\\P:",
"\\??\\R:",
"\\??\\G:",
"\\??\\A:",
"\\??\\Y:"
],
"command_line": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"file_read": [
"\\\\?\\PIPE\\wkssvc",
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
]
},
"first_seen": 1596945190.90625,
"ppid": 2436
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1596945190.34375,
"ppid": 376
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"process_name": "becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"pid": 2436,
"summary": {
"file_created": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"directory_created": [
"C:\\ProgramData\\4b82648b808e5d3665ad"
],
"dll_loaded": [
"KERNEL32.dll",
"shell32.dll",
"kernel32.dll",
"netapi32.dll",
"advapi32.dll",
"SHELL32.dll",
"ntdll.dll",
"user32.dll",
"Winhttp.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"c:\\"
],
"regkey_opened": [
"HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo"
],
"file_written": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"file_exists": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
],
"command_line": [
"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState"
]
},
"first_seen": 1596945190.625,
"ppid": 2308
}
]Signatures
[
{
"markcount": 12,
"families": [],
"description": "Queries for the computername",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945190.812,
"tid": 2124,
"flags": {}
},
"pid": 2436,
"type": "call",
"cid": 1022
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945190.812,
"tid": 2124,
"flags": {}
},
"pid": 2436,
"type": "call",
"cid": 1024
},
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945191.07825,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1019
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945191.07825,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1021
},
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1103
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1105
},
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1133
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1135
},
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1173
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1175
},
{
"call": {
"category": "misc",
"status": 0,
"stacktrace": [],
"last_error": 111,
"nt_status": -1073741568,
"api": "GetComputerNameW",
"return_value": 0,
"arguments": {
"computer_name": ""
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1364
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1366
}
],
"references": [],
"name": "antivm_queries_computername"
},
{
"markcount": 1,
"families": [],
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
"severity": 1,
"marks": [
{
"call": {
"category": "system",
"status": 1,
"stacktrace": [],
"api": "GlobalMemoryStatusEx",
"return_value": 1,
"arguments": {},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1249
}
],
"references": [],
"name": "antivm_memory_available"
},
{
"markcount": 1,
"families": [],
"description": "The file contains an unknown PE resource name possibly indicative of a packer",
"severity": 1,
"marks": [
{
"category": "resource name",
"ioc": "MAD",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "pe_unknown_resource_name"
},
{
"markcount": 0,
"families": [],
"description": "One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.",
"severity": 2,
"marks": [],
"references": [],
"name": "dumped_buffer"
},
{
"markcount": 6,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2436,
"region_size": 45056,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x00330000"
},
"time": 1596945190.734,
"tid": 2124,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2436,
"type": "call",
"cid": 54
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2436,
"region_size": 40960,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x00340000"
},
"time": 1596945190.797,
"tid": 2124,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 2436,
"type": "call",
"cid": 958
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2436,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 49152,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x00400000"
},
"time": 1596945190.797,
"tid": 2124,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2436,
"type": "call",
"cid": 959
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 856,
"region_size": 45056,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x004c0000"
},
"time": 1596945190.98425,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 54
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 856,
"region_size": 40960,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 12288,
"base_address": "0x004d0000"
},
"time": 1596945191.06225,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 958
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 856,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 49152,
"protection": 64,
"process_handle": "0xffffffff",
"base_address": "0x00400000"
},
"time": 1596945191.06225,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 856,
"type": "call",
"cid": 959
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 1,
"families": [],
"description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
"severity": 2,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\",
"free_bytes_available": 23513976832,
"total_number_of_free_bytes": 23513976832,
"total_number_of_bytes": 34252779520
},
"time": 1596945191.60925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1183
}
],
"references": [],
"name": "antivm_disk_size"
},
{
"markcount": 11,
"families": [],
"description": "Foreign language identified in PE resource",
"severity": 2,
"marks": [
{
"name": "RT_ICON",
"language": "LANG_CHINESE",
"offset": "0x0001ae20",
"filetype": "data",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x000008a8"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_RCDATA",
"language": "LANG_CHINESE",
"offset": "0x0001b7e8",
"filetype": "ASCII text, with CRLF line terminators",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000514"
},
{
"name": "RT_GROUP_ICON",
"language": "LANG_CHINESE",
"offset": "0x0001b6c8",
"filetype": "MS Windows icon resource - 1 icon, 32x32",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000014"
},
{
"name": "RT_VERSION",
"language": "LANG_CHINESE",
"offset": "0x0001b6e0",
"filetype": "PDP-11 pure executable not stripped",
"sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
"type": "generic",
"size": "0x00000108"
}
],
"references": [],
"name": "origin_langid"
},
{
"markcount": 1,
"families": [],
"description": "Drops an executable to the user AppData folder",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "exe_appdata"
},
{
"markcount": 24,
"families": [],
"description": "Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32FirstW",
"return_value": 1,
"arguments": {
"process_name": "[System Process]",
"snapshot_handle": "0x00000158",
"process_identifier": 0
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1317
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "System",
"snapshot_handle": "0x00000158",
"process_identifier": 4
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1318
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "smss.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 252
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1319
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "csrss.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 328
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1320
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "wininit.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 376
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1321
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "csrss.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 384
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1322
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "winlogon.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 424
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1323
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "services.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 468
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1324
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "lsass.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 476
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1325
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "lsm.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 484
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1326
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 592
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1327
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 660
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1328
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 712
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1329
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 804
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1330
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 880
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1331
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 276
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1332
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 480
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1333
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "spoolsv.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1084
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1334
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1120
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1335
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1216
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1336
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "svchost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1548
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1337
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "taskhost.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1724
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1338
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "dwm.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1768
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1339
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "Process32NextW",
"return_value": 1,
"arguments": {
"process_name": "explorer.exe",
"snapshot_handle": "0x00000158",
"process_identifier": 1788
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1340
}
],
"references": [],
"name": "injection_process_search"
},
{
"markcount": 1,
"families": [],
"description": "Checks adapter addresses which can be used to detect virtual network interfaces",
"severity": 2,
"marks": [
{
"call": {
"category": "network",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "GetAdaptersAddresses",
"return_value": 111,
"arguments": {
"flags": 15,
"family": 0
},
"time": 1596945191.64125,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1614
}
],
"references": [],
"name": "antivm_network_adapters"
},
{
"markcount": 3,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.182257703826113,
"section": {
"size_of_data": "0x0000c200",
"virtual_address": "0x00006000",
"entropy": 7.182257703826113,
"name": ".data",
"virtual_size": "0x0000c15c"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 7.1735752604921394,
"section": {
"size_of_data": "0x0000a800",
"virtual_address": "0x00013000",
"entropy": 7.1735752604921394,
"name": ".rsrc",
"virtual_size": "0x0000a768"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.8457943925233645,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 2,
"families": [],
"description": "Allocates execute permission to another process indicative of possible code injection",
"severity": 3,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 122880,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1060
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000d0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1061
}
],
"references": [],
"name": "allocates_execute_remote_process"
},
{
"markcount": 1,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
"reg_value": "explorer.exe, \"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe\""
}
],
"references": [],
"name": "persistence_autorun"
},
{
"markcount": 3,
"families": [],
"description": "Manipulates memory of a non-child process indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 856 manipulating memory of non-child process 2820",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 122880,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1060
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000d0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1061
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_modifies_memory"
},
{
"markcount": 4,
"families": [],
"description": "Potential code injection by writing to the memory of another process",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 856 injected into non-child 2820",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x000000dc",
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1062
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "\u0000\u0000\u000b\u0000\u0000\u0000\u000b\u00004\u0018\f\u0000\u00d0\u00e1\u00bbw\u00b5\u00e6\u00bbw:\u00c4\u00bcw\u00aa\u0001\u00bcw&\u00e1\u00bbw",
"process_handle": "0x000000dc",
"base_address": "0x000d0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1081
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "U\u008b\u00ec\u0083\u00e4\u00f8\u0083\u00ec,SV\u008bu\bW\u008b\u001e\u008b~\u0004\u008bC<\u0003\u00c3\u0089D$\u001c+X4\u0083?\u0000t_\u008dG\u0004\u0089D$\u0014\u008b\u0000\u0083\u00f8\brF\u0083\u00c0\u00f8\u00d1\u00e8\u0089D$\u0010\u00ba\u0000\u0000\u0000\u0000t6\u000f\u00b7DW\b\u008b\u00c8\u00c1\u00e8\f\u0081\u00e1\u00ff\u000f\u0000\u0000\u0083\u00f8\u0003t\u0013\u0083\u00f8\nu\u0015\u008b\u0007\u0003\u0006\u0003\u00c1\u0001\u0018\u0083P\u0004\u0000\u00eb\u0007\u008b\u0007\u0003\u0006\u0001\u001c\bB;T$\u0010r\u00ca\u008bD$\u0014\u00038\u0083?\u0000u\u00a1\u008b^\b\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0084\u00a2\u0000\u0000\u0000\u008b\u0006\u0003\u00c1P\u008dD$4P\u008bF\f\u00ff\u00d0j\u0001\u008dD$4P\u008dD$(P\u008bF\u0010\u00ff\u00d0\u008dD$\u0014P\u008dD$$P\u008bF\u0014j\u0000j\u0000\u00ff\u00d0\u008dD$ P\u008bF\u001c\u00ff\u00d0\u008b;\u0003>\u008b[\u0010\u0003\u001e\u008b\u000f\u0085\u00c9t@y\u0005\u000f\u00b7\u00c1\u00eb\u0007\u008b\u0006\u0083\u00c0\u0002\u0003\u00c1P\u008dD$,P\u008bF\f\u00ff\u00d0\u008dD$\u0018Pj\u0000\u008dD$0P\u00fft$ \u008bF\u0018\u00ff\u00d0\u008bD$\u0018\u0083\u00c7\u0004\u0089\u0003\u008b\u000f\u0083\u00c3\u0004\u0085\u00c9u\u00c0\u008b\\$\u0010\u0083\u00c3\u0014\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0085^\u00ff\u00ff\u00ff\u008bD$\u001c\u008b\u000e\u008b@(j\u0000j\u0001Q\u0003\u00c1\u00ff\u00d0_^3\u00c0[\u008b\u00e5]\u00c2\u0004\u0000\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc",
"process_handle": "0x000000dc",
"base_address": "0x000d0020"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1082
}
],
"references": [],
"name": "injection_write_memory"
},
{
"markcount": 2,
"families": [],
"description": "Code injection by writing an executable or DLL to the memory of another process",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 856 injected into non-child 2820",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x000000dc",
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1062
}
],
"references": [],
"name": "injection_write_memory_exe"
},
{
"markcount": 1,
"families": [],
"description": "Expresses interest in specific running processes",
"severity": 3,
"marks": [
{
"category": "process: potential process injection target",
"ioc": "explorer.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "process_interest"
},
{
"markcount": 2,
"families": [],
"description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
"severity": 3,
"marks": [
{
"category": "Process injection",
"ioc": "Process 856 resumed a thread in remote process 0",
"type": "ioc",
"description": null
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "NtResumeThread",
"return_value": 3221225508,
"arguments": {
"thread_handle": "0x000000dc",
"suspend_count": 220,
"process_identifier": 0
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1084
}
],
"references": [
"www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
],
"name": "injection_resumethread"
},
{
"markcount": 12,
"families": [],
"description": "Executed a process and injected code into it, probably while unpacking",
"severity": 5,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 2968,
"thread_handle": "0x000000b8",
"process_identifier": 856,
"current_directory": "",
"filepath": "",
"track": 1,
"command_line": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ",
"filepath_r": "",
"stack_pivoted": 0,
"creation_flags": 0,
"process_handle": "0x000000b4",
"inherit_handles": 0
},
"time": 1596945190.828,
"tid": 2124,
"flags": {
"creation_flags": ""
}
},
"pid": 2436,
"type": "call",
"cid": 1051
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "CreateProcessInternalW",
"return_value": 1,
"arguments": {
"thread_identifier": 2952,
"thread_handle": "0x000000d8",
"process_identifier": 2820,
"current_directory": "",
"filepath": "C:\\Windows\\System32\\secinit.exe",
"track": 1,
"command_line": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe",
"filepath_r": "C:\\Windows\\system32\\secinit.exe",
"stack_pivoted": 0,
"creation_flags": 4,
"process_handle": "0x000000dc",
"inherit_handles": 0
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"creation_flags": "CREATE_SUSPENDED"
}
},
"pid": 856,
"type": "call",
"cid": 1055
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 122880,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1060
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2820,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0x000000dc",
"allocation_type": 12288,
"base_address": "0x000d0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT|MEM_RESERVE"
}
},
"pid": 856,
"type": "call",
"cid": 1061
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"process_handle": "0x000000dc",
"base_address": "0x000b0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1062
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "3bd6282b812ecdc1e609b7320ecaa5a3ac3d6d54",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "",
"process_handle": "0x000000dc",
"base_address": "0x000b1000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1063
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "3428182aaa56f2b241a34ce10316e794f6fddd49",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "",
"process_handle": "0x000000dc",
"base_address": "0x000b6000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1064
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"buffer": "6ba78220f1968a855cef00ba0ece02c691fdd717",
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "",
"process_handle": "0x000000dc",
"base_address": "0x000c3000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1065
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "\u0000\u0000\u000b\u0000\u0000\u0000\u000b\u00004\u0018\f\u0000\u00d0\u00e1\u00bbw\u00b5\u00e6\u00bbw:\u00c4\u00bcw\u00aa\u0001\u00bcw&\u00e1\u00bbw",
"process_handle": "0x000000dc",
"base_address": "0x000d0000"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1081
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "WriteProcessMemory",
"return_value": 1,
"arguments": {
"process_identifier": 2820,
"buffer": "U\u008b\u00ec\u0083\u00e4\u00f8\u0083\u00ec,SV\u008bu\bW\u008b\u001e\u008b~\u0004\u008bC<\u0003\u00c3\u0089D$\u001c+X4\u0083?\u0000t_\u008dG\u0004\u0089D$\u0014\u008b\u0000\u0083\u00f8\brF\u0083\u00c0\u00f8\u00d1\u00e8\u0089D$\u0010\u00ba\u0000\u0000\u0000\u0000t6\u000f\u00b7DW\b\u008b\u00c8\u00c1\u00e8\f\u0081\u00e1\u00ff\u000f\u0000\u0000\u0083\u00f8\u0003t\u0013\u0083\u00f8\nu\u0015\u008b\u0007\u0003\u0006\u0003\u00c1\u0001\u0018\u0083P\u0004\u0000\u00eb\u0007\u008b\u0007\u0003\u0006\u0001\u001c\bB;T$\u0010r\u00ca\u008bD$\u0014\u00038\u0083?\u0000u\u00a1\u008b^\b\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0084\u00a2\u0000\u0000\u0000\u008b\u0006\u0003\u00c1P\u008dD$4P\u008bF\f\u00ff\u00d0j\u0001\u008dD$4P\u008dD$(P\u008bF\u0010\u00ff\u00d0\u008dD$\u0014P\u008dD$$P\u008bF\u0014j\u0000j\u0000\u00ff\u00d0\u008dD$ P\u008bF\u001c\u00ff\u00d0\u008b;\u0003>\u008b[\u0010\u0003\u001e\u008b\u000f\u0085\u00c9t@y\u0005\u000f\u00b7\u00c1\u00eb\u0007\u008b\u0006\u0083\u00c0\u0002\u0003\u00c1P\u008dD$,P\u008bF\f\u00ff\u00d0\u008dD$\u0018Pj\u0000\u008dD$0P\u00fft$ \u008bF\u0018\u00ff\u00d0\u008bD$\u0018\u0083\u00c7\u0004\u0089\u0003\u008b\u000f\u0083\u00c3\u0004\u0085\u00c9u\u00c0\u008b\\$\u0010\u0083\u00c3\u0014\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0085^\u00ff\u00ff\u00ff\u008bD$\u001c\u008b\u000e\u008b@(j\u0000j\u0001Q\u0003\u00c1\u00ff\u00d0_^3\u00c0[\u008b\u00e5]\u00c2\u0004\u0000\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc",
"process_handle": "0x000000dc",
"base_address": "0x000d0020"
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1082
},
{
"call": {
"category": "process",
"status": 0,
"stacktrace": [],
"last_error": 6,
"nt_status": -1073741816,
"api": "NtResumeThread",
"return_value": 3221225508,
"arguments": {
"thread_handle": "0x000000dc",
"suspend_count": 220,
"process_identifier": 0
},
"time": 1596945191.10925,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1084
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtResumeThread",
"return_value": 0,
"arguments": {
"thread_handle": "0x00000124",
"suspend_count": 1,
"process_identifier": 856
},
"time": 1596945191.62525,
"tid": 2968,
"flags": {}
},
"pid": 856,
"type": "call",
"cid": 1265
}
],
"references": [],
"name": "injection_runpe"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 662,
"time": 6.2242820262908936,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5342,
"time": 12.22512698173523,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7186,
"time": 6.184854030609131,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7514,
"time": 4.15946888923645,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7842,
"time": 6.199009895324707,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8170,
"time": 4.664026975631714,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8498,
"time": 3.055079936981201,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8826,
"time": 4.6777260303497314,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28236,
"time": 4.192641019821167,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36620,
"time": 6.271647930145264,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "c653a6d9c5ac360cb66cc6e8c49ea91e79df091235c92238ae0b1871e4ccc8db",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "a5e10eac801ef700319554a756500e604ebeea3ab40dafcf4469f821a781e502",
"irc": [],
"https_ex": []
}Screenshots
gennt.exe removal instructions
The instructions below shows how to remove gennt.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the gennt.exe file for removal, restart your computer and scan it again to verify that gennt.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate gennt.exe in the scan result and tick the checkbox next to the gennt.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate gennt.exe in the scan result.
C:\ProgramData\2bd20eaa905c1c6a2d7d\gennt.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the gennt.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If gennt.exe still remains in the scan result, proceed with the next step. If gennt.exe is gone from the scan result you're done.
- If gennt.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that gennt.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | d7610471691672af41aec15c4880d60e |
| SHA256 | becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100 |
Error Messages
These are some of the error messages that can appear related to gennt.exe:
gennt.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
gennt.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
gennt.exe has stopped working.
End Program - gennt.exe. This program is not responding.
gennt.exe is not a valid Win32 application.
gennt.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with gennt.exe?
To help other users, please let us know what you will do with gennt.exe:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.