Cuckoo Sandbox

File b921dd582b6c639b_winhelp25.exe

Summary
Download Resubmit sample

Size	52.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`df0196f8f40ad2f770bf8c55169d1d2f`
SHA1	`c64615115b93917b2bbff1bd4821c64f3c52fd20`
SHA256	`b921dd582b6c639bec220efc0229557554389fb024d2765638fdd9835df4b900`
SHA512	`5235533e878034f41b6c7e61e8352d66fadaaf411ddb415cbabe198a84f5095e5ce5b4044751a5a3f57da9a162dbf03adf6cdc57c1b30a2ed705778e79559be8`
CRC32	`43CC6033`
ssdeep	`None`
Yara	RSharedStrings - identifiers for remote and gmremote

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6880483

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	Aug. 26, 2025, 2:35 a.m.	Aug. 26, 2025, 2:39 a.m.	276 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-08-23 23:27:29,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpsgyfoe
2025-08-23 23:27:29,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\okbQiyVfCIdhxKEboSZzUpsPurYE
2025-08-23 23:27:29,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\bZEVPiYGAwyjQEifv
2025-08-23 23:27:29,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-08-23 23:27:29,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-08-23 23:27:29,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-08-23 23:27:29,265 [analyzer] DEBUG: Started auxiliary module DbgView
2025-08-23 23:27:29,625 [analyzer] DEBUG: Started auxiliary module Disguise
2025-08-23 23:27:29,842 [analyzer] DEBUG: Loaded monitor into process with pid 516
2025-08-23 23:27:29,842 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-08-23 23:27:29,842 [analyzer] DEBUG: Started auxiliary module Human
2025-08-23 23:27:29,842 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-08-23 23:27:29,842 [analyzer] DEBUG: Started auxiliary module Reboot
2025-08-23 23:27:29,905 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-08-23 23:27:29,905 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-08-23 23:27:29,921 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-08-23 23:27:29,921 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-08-23 23:27:30,030 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\b921dd582b6c639b_winhelp25.exe' with arguments '' and pid 2084
2025-08-23 23:27:30,203 [analyzer] DEBUG: Loaded monitor into process with pid 2084
2025-08-23 23:27:30,217 [analyzer] INFO: Added new file to list with pid 2084 and path C:\Users\Administrator\AppData\Local\Temp\27441921.reg
2025-08-23 23:27:30,296 [analyzer] INFO: Injected into process with pid 2648 and name u'regedit.exe'
2025-08-23 23:27:30,296 [analyzer] INFO: Added new file to list with pid 2084 and path C:\Windows\SysWOW64\WinHelp21.exe
2025-08-23 23:27:30,500 [analyzer] DEBUG: Loaded monitor into process with pid 2648
2025-08-23 23:27:31,030 [analyzer] INFO: Process with pid 2648 has terminated
2025-08-23 23:27:35,296 [analyzer] INFO: Injected into process with pid 2412 and name u'WinHelp21.exe'
2025-08-23 23:27:35,453 [analyzer] DEBUG: Loaded monitor into process with pid 2412
2025-08-23 23:27:35,515 [analyzer] INFO: Injected into process with pid 2056 and name u'svchost.exe'
2025-08-23 23:27:36,030 [analyzer] INFO: Process with pid 2084 has terminated
2025-08-23 23:27:37,030 [analyzer] INFO: Process with pid 2412 has terminated
2025-08-23 23:27:38,030 [analyzer] INFO: Process with pid 2056 has terminated
2025-08-23 23:27:38,030 [analyzer] INFO: Process list is empty, terminating analysis.
2025-08-23 23:27:39,217 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-08-23 23:27:39,233 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-08-26 02:35:06,618 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:07,649 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:08,678 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:09,700 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:10,719 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:11,748 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:12,767 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:13,787 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:14,807 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:15,827 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:16,856 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:17,875 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:18,893 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:19,909 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:20,930 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:21,952 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:22,973 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:23,995 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:25,124 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:26,142 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:27,165 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:28,189 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:29,207 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:30,228 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:31,250 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:32,420 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:33,446 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:34,654 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:35,838 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:36,857 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:37,879 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:38,898 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:39,917 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:40,951 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:42,160 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:43,438 [cuckoo.core.scheduler] DEBUG: Task #6904830: no machine available yet
2025-08-26 02:35:44,706 [cuckoo.core.scheduler] INFO: Task #6904830: acquired machine win7x6413 (label=win7x6413)
2025-08-26 02:35:44,708 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.213 for task #6904830
2025-08-26 02:35:45,248 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1263295 (interface=vboxnet0, host=192.168.168.213)
2025-08-26 02:35:45,566 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6413
2025-08-26 02:35:46,327 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6413 to vmcloak
2025-08-26 02:37:41,003 [cuckoo.core.guest] INFO: Starting analysis #6904830 on guest (id=win7x6413, ip=192.168.168.213)
2025-08-26 02:37:42,008 [cuckoo.core.guest] DEBUG: win7x6413: not ready yet
2025-08-26 02:37:47,026 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6413, ip=192.168.168.213)
2025-08-26 02:37:47,128 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6413, ip=192.168.168.213, monitor=latest, size=6660546)
2025-08-26 02:37:48,238 [cuckoo.core.resultserver] DEBUG: Task #6904830: live log analysis.log initialized.
2025-08-26 02:37:49,063 [cuckoo.core.resultserver] DEBUG: Task #6904830 is sending a BSON stream
2025-08-26 02:37:49,438 [cuckoo.core.resultserver] DEBUG: Task #6904830 is sending a BSON stream
2025-08-26 02:37:49,672 [cuckoo.core.resultserver] DEBUG: Task #6904830 is sending a BSON stream
2025-08-26 02:37:50,301 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'shots/0001.jpg'
2025-08-26 02:37:50,373 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 133597
2025-08-26 02:37:54,635 [cuckoo.core.resultserver] DEBUG: Task #6904830 is sending a BSON stream
2025-08-26 02:37:54,719 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'files/b921dd582b6c639b_b921dd582b6c639b_winhelp25.exe'
2025-08-26 02:37:54,722 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 53782
2025-08-26 02:37:58,359 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'curtain/1755984459.11.curtain.log'
2025-08-26 02:37:58,368 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 36
2025-08-26 02:37:58,990 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'sysmon/1755984459.22.sysmon.xml'
2025-08-26 02:37:59,308 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 604524
2025-08-26 02:37:59,315 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'files/438284f15009ddb2_27441921.reg'
2025-08-26 02:37:59,320 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 384
2025-08-26 02:37:59,327 [cuckoo.core.resultserver] DEBUG: Task #6904830: File upload for 'files/6b15d2cf1313dae6_winhelp21.exe'
2025-08-26 02:37:59,336 [cuckoo.core.resultserver] DEBUG: Task #6904830 uploaded file length: 61085
2025-08-26 02:37:59,338 [cuckoo.core.resultserver] DEBUG: Task #6904830 had connection reset for <Context for LOG>
2025-08-26 02:38:00,029 [cuckoo.core.guest] INFO: win7x6413: analysis completed successfully
2025-08-26 02:38:00,233 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-08-26 02:38:00,268 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-08-26 02:38:01,544 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6413 to path /srv/cuckoo/cwd/storage/analyses/6904830/memory.dmp
2025-08-26 02:38:01,555 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6413
2025-08-26 02:39:42,120 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.213 for task #6904830
2025-08-26 02:39:42,734 [cuckoo.core.scheduler] DEBUG: Released database task #6904830
2025-08-26 02:39:42,756 [cuckoo.core.scheduler] INFO: Task #6904830: analysis procedure completed

Signatures

Yara rule detected for file (1 event)

description

identifiers for remote and gmremote

rule

RSharedStrings

Allocates read-write-execute memory (usually to unpack itself) (50 out of 172 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13152000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.ex_cod
section	.ex_rsc
section	.ccc

The executable uses a known packer (1 event)

packer

eXPressor v1.3 -> CGSoftLabs

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Foreign language identified in PE resource (3 events)

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 48 x 96 x 32, image size 9216

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000140f0

size

0x000025a8

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00016698

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000166ac

size

0x00000348

Creates executable files on the filesystem (2 events)

file	C:\Users\Administrator\AppData\Local\Temp\27441921.reg
file	C:\Windows\System32\WinHelp21.exe

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\svchost.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\b921dd582b6c639b_winhelp25.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00004dcf', u'virtual_address': u'0x00001000', u'entropy': 7.992448818985285, u'name': u'.data', u'virtual_size': u'0x00011000'}

entropy

7.99244881899

description

A section with a high entropy has been found

entropy

0.48760128271

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 24, 2025, 12:27 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: cead43137be0820f04e3bcd28a7ee3b40209352e

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2056 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFF8FD86-05DB-4990-92A9-0EE5FDFB7BFE}\stubpath

reg_value

C:\Windows\system32\WinHelp21.exe

Deletes executed files from disk (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\b921dd582b6c639b_winhelp25.exe

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Process injection

Process 2412 created a remote thread in non-child process 2056

Time & API	Arguments	Status	Return	Repeated
CreateRemoteThread Aug. 24, 2025, 12:27 a.m.	thread_identifier: 0 process_identifier: 2056 function_address: 0x13157d20 flags: 0 stack_size: 0 parameter: 0x13150000 process_handle: 0x000000f0	1	236	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Process injection

Process 2412 manipulating memory of non-child process 2056

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 24, 2025, 12:27 a.m.	process_identifier: 2056 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0	0

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Gen:Variant.Barys.494697 (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Trj]
C4S ClamAV (Linux)	Win.Dropper.Gh0stRAT-7645027-0
Trellix (Linux)	Generic Malware.dq trojan
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Gen:Variant.Barys.494697(DB)
ESET Security (Windows)	Win32/Farfli.AAG trojan
Sophos Anti-Virus (Linux)	Troj/Farfli-DL
DrWeb Antivirus (Linux)	Trojan.DownLoad3.17387
ClamAV (Linux)	Win.Dropper.Gh0stRAT-7645027-0
Bitdefender Antivirus (Linux)	Gen:Variant.Barys.494697
Kaspersky Standard (Windows)	HEUR:Trojan-Dropper.Win32.Injector.gen
Emsisoft Commandline Scanner (Windows)	Gen:Variant.Barys.494697 (B)

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File b921dd582b6c639b_winhelp25.exe

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample