Hostile ^92% windows Download

tx_1787549142555.exe

Process hollowing and injection APIs

Dynamically resolved process-hollowing API chainPE entry point in .reloc section

SHA-256e664a3cd0f9138b2b86cec56bf438849e45ec00117ef0bd19465eec1af19c92c

URLhttps://tria.ge/api/v0/samples/260824-g9lwpadk9z/sample

MaleculeO₂(Er₂As)H₄(Cm₂Mg₂Os₂Po₄)Md(Bi₅)

Evidence

References the IsDebuggerPresent API 0x37fd0–0x38110

⋯3 more rows
0x3800000010203040506070a0b0e0f0c0d0e0f................
0x380100203040506070a0b0e0f0a0b0c0d0e0f................
0x380200001040506070a0b0e0f0a0b0c0d0e0f................
0x38030040506070a0b0e0f08090a0b0c0d0e0f................
0x380400001020306070a0b0e0f0a0b0c0d0e0f................
0x38050020306070a0b0e0f08090a0b0c0d0e0f................
0x38060000106070a0b0e0f08090a0b0c0d0e0f................
0x3807006070a0b0e0f060708090a0b0c0d0e0f................
0x380800001020304050a0b0e0f0a0b0c0d0e0f................
0x38090020304050a0b0e0f08090a0b0c0d0e0f................
0x380a0000104050a0b0e0f08090a0b0c0d0e0f................
0x380b004050a0b0e0f060708090a0b0c0d0e0f................
⋯6 more rows

Uses internet communication API imports 0x38150–0x38270

⋯8 more rows
0x381d0020308090e0f060708090a0b0c0d0e0f................
0x381e0000108090e0f060708090a0b0c0d0e0f................
0x381f008090e0f0405060708090a0b0c0d0e0f................
0x3820000010203040506070e0f0a0b0c0d0e0f................
⋯7 more rows

IsDebuggerPresent API name in PE strings 0x421b6–0x42286

⋯3 more rows
0x421e669727475616c556e77696e640000af03irtualUnwind....
0x421f64973446562756767657250726573656eIsDebuggerPresen
0x422067400fa05556e68616e646c6564457863t...UnhandledExc
0x42216657074696f6e46696c7465720000b705eptionFilter....
⋯7 more rows

Suspicious .reloc section (high entropy) 0x42dc0–0x42e90

⋯3 more rows
0x42df000000000000000000000000000000000................
0x42e00008003002000000040a348a350a358a3.... [email protected].
0x42e1060a370a380a388a390a3a8a3b0a30000`.p.............
0x42e2000a003005c00000040a948a950a958a9....\[email protected].
⋯7 more rows

Dynamically resolved process-hollowing API chain 0x43e86–0x44076

⋯5 more rows
0x43ed62e646c6c006e74646c6c2e646c6c0056.dll.ntdll.dll.V
0x43ee669727475616c416c6c6f630052746c44irtualAlloc.RtlD
0x43ef665636f6d707265737342756666657200ecompressBuffer.
0x43f0643726561746550726f63657373410056CreateProcessA.V
0x43f1669727475616c416c6c6f634578005772irtualAllocEx.Wr
0x43f2669746550726f636573734d656d6f7279iteProcessMemory
0x43f36005265616450726f636573734d656d6f.ReadProcessMemo
0x43f46727900476574546872656164436f6e74ry.GetThreadCont
0x43f5665787400536574546872656164436f6eext.SetThreadCon
0x43f667465787400526573756d655468726561text.ResumeThrea
0x43f766400436c6f736548616e646c65004765d.CloseHandle.Ge
0x43f86744d6f64756c6546696c654e616d6541tModuleFileNameA
0x43f96004e74556e6d6170566965774f665365.NtUnmapViewOfSe
0x43fa66374696f6e004e745175657279496e66ction.NtQueryInf
0x43fb66f726d6174696f6e50726f6365737300ormationProcess.
0x43fc690909090909090909090909090909090................
⋯11 more rows