Detect Neshta payload

Modifies security service

Neshta

Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

Phorphiex payload

Phorphiex, Phorpiex

Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner payload

Downloads MZ/PE file