ceshi.exe

This executable has a PDB path (1 event)

pdb_path

c:\Users\Administrator\Desktop\Server111\Release\DHLDAT.pdb

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://103.97.178.89/NetSyst96.dll

Performs some HTTP requests (1 event)

request

GET http://103.97.178.89/NetSyst96.dll

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

zlaiyy.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 7, 2023, 7:34 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 3203072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 7, 2023, 7:34 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1030f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 7, 2023, 7:34 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 3203072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory June 7, 2023, 7:34 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1030f000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (2 events)

file	C:\Program Files (x86)\Microsoft Krptvw\Mxqekzr.exe
file	C:\Program Files\AppPatch\NetSyst96.dll

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA June 7, 2023, 7:34 a.m.	service_start_name: start_type: 2 password: display_name: Ahejvg evdbbvjgbdzsogyiyg filepath: C:\Program Files (x86)\Microsoft Krptvw\Mxqekzr.exe service_name: Wszdfq ofnllftq filepath_r: C:\Program Files (x86)\Microsoft Krptvw\Mxqekzr.exe desired_access: 983551 service_handle: 0x00326de8 error_control: 0 service_type: 272 service_manager_handle: 0x00326d48	1	3304936	0

Drops a binary and executes it (1 event)

file	C:\Program Files (x86)\Microsoft Krptvw\Mxqekzr.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 7, 2023, 7:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 7, 2023, 7:34 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (2 events)

host	121.254.136.27
host	45.12.253.105

Installs itself for autorun at Windows startup (1 event)

service_name

Wszdfq ofnllftq

service_path

C:\Program Files (x86)\Microsoft Krptvw\Mxqekzr.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49187

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Cycler.tobt
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Downldr.Farli.S673162
Malwarebytes	Malware.AI.4250901208
Zillya	Trojan.Cycler.Win32.1992
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0052d5311 )
Alibaba	TrojanDownloader:Win32/Farfli.77d44165
K7GW	Trojan ( 0052d5311 )
Cybereason	malicious.067e14
Cyren	W32/Trojan.QYHJ-1514
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Farfli.CGF
APEX	Malicious
ClamAV	Win.Trojan.Agent-6443182-0
Kaspersky	Trojan-Clicker.Win32.Cycler.amco
BitDefender	Trojan.Cud.Gen.1
NANO-Antivirus	Trojan.Win32.Farfli.ekovmh
MicroWorld-eScan	Trojan.Cud.Gen.1
Avast	Win32:Malware-gen
Rising	Downloader.Farfli!8.2C32 (TFE:5:7kjdrStSW2Q)
Emsisoft	Trojan.Cud.Gen.1 (B)
F-Secure	Heuristic.HEUR/AGEN.1317193
DrWeb	BackDoor.PcClient.6595
VIPRE	Trojan.Cud.Gen.1
TrendMicro	BKDR_ZEGOST.SM33
McAfee-GW-Edition	GenericRXAW-IL!25214EE067E1
FireEye	Generic.mg.25214ee067e1480f
Sophos	Mal/Generic-S
GData	Trojan.Cud.Gen.1
Jiangmin	TrojanDownloader.Agent.fkra
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1317193
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Clicker]/Win32.Cycler
Gridinsoft	Trojan.Win32.Gen.bot
Xcitium	Backdoor.Win32.Farfli.CK@709g8g
Arcabit	Trojan.Cud.Gen.1
ZoneAlarm	Trojan-Clicker.Win32.Cycler.amco
Microsoft	TrojanDownloader:Win32/Farfli.F!bit
Google	Detected
AhnLab-V3	Downloader/Win32.Agent.C1745448
McAfee	GenericRXAW-IL!25214EE067E1
VBA32	TrojanClicker.Cycler
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	BKDR_ZEGOST.SM33
Tencent	Malware.Win32.Gencirc.10b2ab54