Summary

f8ea354785b862c5_svchost.exe

File f8ea354785b862c5_svchost.exe

Summary
Download Resubmit sample

Size 358.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 106e7e6a7935bc00282333d7744000e8
SHA1 02777c58ce934d5cbaba49af076ece4899da0245
SHA256 f8ea354785b862c50889e5cf0a6e30ce6027be702f049ce9a6a1400d17fab550
SHA512
c90e5d7e5c5203928d0ff559e838d2ef16e94018898c0b185c78471d34fc9997993ed4d195fd67de5e3f8dcd9dc88c9cd051480274fbcdf96755cc9172e38628
CRC32 786B1AE9
ssdeep None
Yara
  • spyeye - SpyEye X.Y memory
  • shifu_shiz - Memory string yara for Shifu/Shiz
  • SEH__vectored - (no description)
  • antisb_threatExpert - Anti-Sandbox checks for ThreatExpert
  • antivm_bios - AntiVM checks for Bios version
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • network_http - Communications over HTTP
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • escalate_priv - Escalade priviledges

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6772929

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 31, 2025, 1:09 a.m. July 31, 2025, 1:17 a.m. 499 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-27 16:06:07,015 [analyzer] DEBUG: Starting analyzer from: C:\tmphzbxu3
2025-07-27 16:06:07,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\VYADPLKNsMvjKYgJnCmSelKqkzZO
2025-07-27 16:06:07,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\FAcypaiVeuANTAmkfDiGnPVt
2025-07-27 16:06:07,030 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-27 16:06:07,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-27 16:06:07,375 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-27 16:06:07,375 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-27 16:06:08,125 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-27 16:06:08,328 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-07-27 16:06:08,328 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-27 16:06:08,328 [analyzer] DEBUG: Started auxiliary module Human
2025-07-27 16:06:08,328 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-27 16:06:08,328 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-27 16:06:08,421 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-27 16:06:08,421 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-27 16:06:08,421 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-27 16:06:08,421 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-27 16:06:08,592 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\f8ea354785b862c5_svchost.exe' with arguments '' and pid 2876
2025-07-27 16:06:08,780 [analyzer] DEBUG: Loaded monitor into process with pid 2876
2025-07-27 16:06:09,046 [analyzer] INFO: Added new file to list with pid 2876 and path C:\Windows\AppPatch\svchost.exe
2025-07-27 16:06:09,125 [analyzer] INFO: Injected into process with pid 2360 and name u'svchost.exe'
2025-07-27 16:06:09,592 [analyzer] INFO: Process with pid 2876 has terminated
2025-07-27 16:09:27,625 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-27 16:09:29,108 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-27 16:09:29,108 [lib.api.process] INFO: Successfully terminated process with pid 2360.
2025-07-27 16:09:29,125 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-31 01:09:16,748 [cuckoo.core.scheduler] INFO: Task #6792714: acquired machine win7x6425 (label=win7x6425)
2025-07-31 01:09:16,749 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.225 for task #6792714
2025-07-31 01:09:17,401 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2604693 (interface=vboxnet0, host=192.168.168.225)
2025-07-31 01:09:17,688 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6425
2025-07-31 01:09:18,882 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6425 to vmcloak
2025-07-31 01:11:25,167 [cuckoo.core.guest] INFO: Starting analysis #6792714 on guest (id=win7x6425, ip=192.168.168.225)
2025-07-31 01:11:26,173 [cuckoo.core.guest] DEBUG: win7x6425: not ready yet
2025-07-31 01:11:31,200 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6425, ip=192.168.168.225)
2025-07-31 01:11:31,313 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6425, ip=192.168.168.225, monitor=latest, size=6660546)
2025-07-31 01:11:33,083 [cuckoo.core.resultserver] DEBUG: Task #6792714: live log analysis.log initialized.
2025-07-31 01:11:34,366 [cuckoo.core.resultserver] DEBUG: Task #6792714 is sending a BSON stream
2025-07-31 01:11:35,024 [cuckoo.core.resultserver] DEBUG: Task #6792714 is sending a BSON stream
2025-07-31 01:11:35,237 [cuckoo.core.resultserver] DEBUG: Task #6792714: File upload for 'files/f8ea354785b862c5_7718.tmp'
2025-07-31 01:11:35,255 [cuckoo.core.resultserver] DEBUG: Task #6792714 uploaded file length: 367104
2025-07-31 01:11:35,644 [cuckoo.core.resultserver] DEBUG: Task #6792714: File upload for 'shots/0001.jpg'
2025-07-31 01:11:35,672 [cuckoo.core.resultserver] DEBUG: Task #6792714 uploaded file length: 133489
2025-07-31 01:11:48,413 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:12:04,865 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:12:21,043 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:12:36,673 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:12:52,240 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:13:07,414 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:13:23,100 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:13:38,237 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:13:53,362 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:14:09,769 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:14:25,408 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:14:40,967 [cuckoo.core.guest] DEBUG: win7x6425: analysis #6792714 still processing
2025-07-31 01:14:53,935 [cuckoo.core.resultserver] DEBUG: Task #6792714: File upload for 'curtain/1753625367.81.curtain.log'
2025-07-31 01:14:53,947 [cuckoo.core.resultserver] DEBUG: Task #6792714 uploaded file length: 36
2025-07-31 01:14:54,749 [cuckoo.core.resultserver] DEBUG: Task #6792714: File upload for 'sysmon/1753625368.5.sysmon.xml'
2025-07-31 01:14:55,235 [cuckoo.core.resultserver] DEBUG: Task #6792714 uploaded file length: 8403638
2025-07-31 01:14:55,265 [cuckoo.core.resultserver] DEBUG: Task #6792714: File upload for 'files/c5f2fe572a6ce0a5_svchost.exe'
2025-07-31 01:14:55,281 [cuckoo.core.resultserver] DEBUG: Task #6792714 uploaded file length: 367104
2025-07-31 01:14:55,284 [cuckoo.core.resultserver] DEBUG: Task #6792714 had connection reset for <Context for LOG>
2025-07-31 01:14:56,749 [cuckoo.core.guest] INFO: win7x6425: analysis completed successfully
2025-07-31 01:14:56,793 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-31 01:14:56,822 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-31 01:14:58,698 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6425 to path /srv/cuckoo/cwd/storage/analyses/6792714/memory.dmp
2025-07-31 01:14:58,699 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6425
2025-07-31 01:17:35,386 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.225 for task #6792714
2025-07-31 01:17:35,729 [cuckoo.core.scheduler] DEBUG: Released database task #6792714
2025-07-31 01:17:35,744 [cuckoo.core.scheduler] INFO: Task #6792714: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description SpyEye X.Y memory rule spyeye
description Memory string yara for Shifu/Shiz rule shifu_shiz
description (no description) rule SEH__vectored
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description AntiVM checks for Bios version rule antivm_bios
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Communications over HTTP rule network_http
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Escalade priviledges rule escalate_priv
Creates executable files on the filesystem (1 event)
file C:\Windows\AppPatch\svchost.exe
Creates a suspicious process (1 event)
cmdline C:\Windows\AppPatch\svchost.exe
Drops a binary and executes it (1 event)
file C:\Windows\AppPatch\svchost.exe
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
Created a process named as a common system process (1 event)
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1464
thread_handle: 0x00000100
process_identifier: 2360
current_directory:
filepath: C:\Windows\AppPatch\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\apppatch\svchost.exe
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x0000010c
1 1 0
Attempts to identify installed AV products by installation directory (1 event)
file C:\Program Files (x86)\AVG\AVG9\dfncfg.dat
Checks the version of Bios, possibly for anti-virtualization (1 event)
registry HKEY_LOCAL_MACHINE\SystemBiosVersion
File has been identified by 12 AntiVirus engine on IRMA as malicious (12 events)
G Data Antivirus (Windows) Virus: Backdoor.Simda.A (Engine A), Win32.Trojan.Spyshiz.A (Engine B)
Avast Core Security (Linux) Win32:Shiz-JT [Trj]
C4S ClamAV (Linux) Win.Trojan.Shiz-9949267-0
Trellix (Linux) BackDoor-FDOB
WithSecure (Linux) Trojan.TR/Hijacker.Gen
eScan Antivirus (Linux) Backdoor.Simda.A(DB)
ESET Security (Windows) a variant of Win32/Spy.Shiz.NBX trojan
Sophos Anti-Virus (Linux) Troj/Shiz-Gen
DrWeb Antivirus (Linux) Trojan.PWS.Ibank.300
Bitdefender Antivirus (Linux) Backdoor.Simda.A
Kaspersky Standard (Windows) HEUR:Backdoor.Win32.Generic
Emsisoft Commandline Scanner (Windows) Backdoor.Simda.A (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.