Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 14, 2021, 1:55 p.m.	June 14, 2021, 2:12 p.m.

Size	2.9MB
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`c0142e34a4293c9468c70596bd8ebfdb`
SHA256	`8abc209952e766af135062edb33e10efa722e83bc3f08cbae98b4750be87a5bd`
CRC32	`5D3C7EE7`
ssdeep	`49152:xBzepSAvUCOVFqJ36d8qRf6A58XZJSsg:3zepSAcCOHqJhZJSsg`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)

Name	Response	Post-Analysis Lookup
xmr-eu1.nanopool.org	A 51.15.58.224 A 51.255.34.118 A 51.15.54.102 A 51.83.33.228 A 51.15.65.182 A 217.182.169.148 A 51.15.69.136 A 51.15.78.68	51.83.33.228

Flow	SID	Signature	Category
TCP 192.168.56.102:49805 -> 51.15.78.68:14444	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 14, 2021, 1:55 p.m.		1	1	0

Time & API	Arguments	Status
NtAllocateVirtualMemory June 14, 2021, 1:55 p.m.	process_identifier: 2352 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 14, 2021, 1:55 p.m.	process_identifier: 2352 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 14, 2021, 1:55 p.m.	process_identifier: 2352 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002610000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1

host

172.217.25.14

Time & API	Arguments	Status	Return	Repeated
CreateServiceW June 14, 2021, 1:55 p.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys desired_access: 983551 service_handle: 0x00000000005f67f0 error_control: 1 service_type: 1 service_manager_handle: 0x00000000005f67c0	1	6252528	0

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 14, 2021, 1:55 p.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46463985
McAfee	Artemis!C0142E34A429
K7AntiVirus	Adware ( 0055631f1 )
Alibaba	Trojan:Win32/CoinMiner.ali1004001
K7GW	Adware ( 0055631f1 )
Cybereason	malicious.3b7e29
Cyren	W64/Trojan.XNTM-3997
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/CoinMiner.PO potentially unwanted
APEX	Malicious
Avast	Win64:CoinminerX-gen [Trj]
ClamAV	Win.Coinminer.Generic-7151253-0
Kaspersky	HEUR:Trojan.Win32.Miner.gen
BitDefender	Trojan.GenericKD.46463985
Paloalto	generic.ml
Tencent	Win32.Trojan.Miner.Sttk
Ad-Aware	Trojan.GenericKD.46463985
Emsisoft	Trojan.GenericKD.46463985 (B)
DrWeb	Tool.BtcMine.2110
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win64.PUP.vh
FireEye	Generic.mg.c0142e34a4293c94
Sophos	Generic PUA AM (PUA)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1136970
MAX	malware (ai score=87)
Microsoft	PUA:Win32/CoinMiner
Gridinsoft	Risk.CoinMiner.B.vl!yf
ZoneAlarm	HEUR:Trojan.Win32.Miner.gen
GData	Win32.Application.CoinMiner.Y
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.46463985
Malwarebytes	Malware.AI.3163882265
TrendMicro-HouseCall	TROJ_GEN.R06CH0CF921
Rising	HackTool.CoinMiner!1.B971 (CLASSIC)
Ikarus	PUA.CoinMiner
Fortinet	W64/CoinMiner.PO!tr
AVG	Win64:CoinminerX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_70% (D)

gcc.exe