Created SysWOW64 executable runs under services.exe at System integrity
A file created in SysWOW64 matches a process recorded under services.exe at System integrity. Sandbox reports also show requests for TXT records beneath two .xyz domains, but do not tie those requests to the service-launched process or show what the resolver returned.
An executable created under C:\Windows\SysWOW64 appears in a process-creation event with services.exe as its parent and System integrity. In sandbox reports for the submitted sample, requests also reach a resolver’s web interface to ask for TXT records beneath two .xyz domains. These observations raise a more useful question than whether the domains look suspicious: what does the executable actually establish on the host, and what information does it seek from DNS?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read