Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 14, 2021, 3:39 p.m.	June 14, 2021, 3:44 p.m.

Size	1.7MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`8499a6b941c62297c4ed8149f2c181fb`
SHA256	`92d91382245569b874ae5d0cdb3049864e20b93824a065521c3a2f7800d62bee`
CRC32	`ABE4532D`
ssdeep	`24576:UaQ/2ZCdibELOLihGiiiw7J0I02p5BvDNRQxH8JZPjd8nBPeaQPC9Ye:dQ/2YdDiLic3tH02pX6H87bhkYe`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) OS_Processor_Check_Zero - OS Processor Check

Name	Response	Post-Analysis Lookup
xmr-eu1.nanopool.org	A 51.15.58.224 A 51.255.34.118 A 51.15.54.102 A 51.83.33.228 A 51.15.65.182 A 217.182.169.148 A 51.15.69.136 A 51.15.78.68	51.15.54.102

Flow	SID	Signature	Category
TCP 192.168.56.102:49810 -> 51.15.58.224:14444	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 14, 2021, 3:40 p.m.		1	1	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 14, 2021, 3:39 p.m.	process_identifier: 2208 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory June 14, 2021, 3:40 p.m.	process_identifier: 2208 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000020900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

host

172.217.25.14

Time & API	Arguments	Status	Return	Repeated
CreateServiceW June 14, 2021, 3:40 p.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Local\Temp\WinRing0x64.sys desired_access: 983551 service_handle: 0x00000000002ebe90 error_control: 1 service_type: 1 service_manager_handle: 0x00000000002ebe60	1	3063440	0

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 14, 2021, 3:40 p.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46473846
FireEye	Generic.mg.8499a6b941c62297
McAfee	Artemis!8499A6B941C6
K7AntiVirus	Adware ( 005577a81 )
Alibaba	Trojan:Win32/CoinMiner.ali1004001
K7GW	Adware ( 005577a81 )
CrowdStrike	win/malicious_confidence_90% (D)
Cyren	W64/Trojan.EFRC-0263
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/CoinMiner.PR potentially unwanted
APEX	Malicious
Avast	Win64:Malware-gen
ClamAV	Win.Coinminer.Generic-7151253-0
Kaspersky	HEUR:Trojan.Win32.Miner.gen
BitDefender	Trojan.GenericKD.46473846
Paloalto	generic.ml
Tencent	Win32.Trojan.Miner.Eanh
Ad-Aware	Trojan.GenericKD.46473846
Sophos	XMRig Miner (PUA)
TrendMicro	Coinminer.Win64.TOOLXMR.SMA
McAfee-GW-Edition	BehavesLike.Win64.CoinMiner.th
Emsisoft	Trojan.GenericKD.46473846 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1134782
MAX	malware (ai score=89)
Microsoft	PUA:Win32/CoinMiner
Gridinsoft	Risk.CoinMiner.B.vl!yf
Arcabit	Trojan.Generic.D2C52276
AegisLab	Trojan.Win32.Miner.4!c
ZoneAlarm	HEUR:Trojan.Win32.Miner.gen
GData	Win64.Application.Coinminer.CP
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Miner3.Exp
Acronis	suspicious
Malwarebytes	Trojan.BitCoinMiner.Generic
Rising	HackTool.CoinMiner!1.B971 (CLASSIC)
Ikarus	PUA.CoinMiner
eGambit	Unsafe.AI_Score_91%
Fortinet	Riskware/CoinMiner
AVG	Win64:Malware-gen
Cybereason	malicious.2301b1
Panda	Trj/CI.A

msvc.exe