SmartHawk

16.0

0-day

45 个模型检测该样本为恶意！

重新分析

下载样本

31e26a8d79a101c2ede82d2b74380cbd124f62ebafb86d2cc6320222010881b7

01c4468f12ec9c8840f39d36ae80e9ba.exe

分析耗时

77s

最近分析

文件大小

510.0KB

静态报毒动态报毒 5H0ISD AI SCORE=89 ATTRIBUTE CONFIDENCE DOWNLOADER34 FM0@AUHSCI GDSDA GENERICKD GENERICRXLV HACKTOOL HIGH CONFIDENCE HIGHCONFIDENCE ICBYPASS MALICIOUS PE MHWYG NANCAT NANOBOT NANOCORE R03AC0WI220 TSCOPE UNSAFE WOREFLINT ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXLV-UT!01C4468F12EC	20200904	6.0.6.653
Alibaba	Backdoor:MSIL/Injector.9674b1c1	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200904	18.4.3895.0
Tencent	Msil.Backdoor.Nanobot.Eye	20200904	1.0.0.1
Kingsoft		20200904	2013.8.14.323
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620139846.48875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620139840.78525 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620139843.91025 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119620.963662 IsDebuggerPresent		failed	0	0
1620139838.84875 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620139841.61325 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service"。 console_handle: 0x00000007	success	1	0
1620139844.16025 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service Task"。 console_handle: 0x00000007	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119653.260662 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 个事件)

domain

napymon81.dyndns.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 126 个事件)

Time & API	Arguments	Status
1620119619.806662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00930000	success
1620119619.806662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa0000	success
1620119620.635662 NtProtectVirtualMemory	process_identifier: 2272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1620119620.963662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success
1620119620.963662 NtProtectVirtualMemory	process_identifier: 2272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1620119620.963662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success
1620119621.260662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success
1620119621.494662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00433000	success
1620119621.525662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046b000	success
1620119621.525662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00467000	success
1620119621.588662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043c000	success
1620119622.213662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00434000	success
1620119622.213662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00435000	success
1620119622.260662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00436000	success
1620119622.275662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f0000	success
1620119622.338662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success
1620119622.431662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success
1620119622.447662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success
1620119622.510662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00465000	success
1620119622.619662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success
1620119622.619662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success
1620119622.635662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042b000	success
1620119622.650662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success
1620119622.650662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f1000	success
1620119622.713662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00438000	success
1620119622.713662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00439000	success
1620119622.728662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a0000	success
1620119622.822662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f2000	success
1620119622.916662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f5000	success
1620119623.041662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a1000	success
1620119623.041662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009ff000	success
1620119623.041662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009f0000	success
1620119623.103662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1620119653.150662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a2000	success
1620119653.150662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043d000	success
1620119653.213662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a3000	success
1620119653.244662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f6000	success
1620119653.291662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f7000	success
1620119654.369662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a4000	success
1620119654.494662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f8000	success
1620119654.572662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a5000	success
1620119654.760662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f9000	success
1620119655.025662 NtAllocateVirtualMemory	process_identifier: 2272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02310000	success
1620139838.66075 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00aa0000	success
1620139838.66075 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00be0000	success
1620139838.75475 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1620139838.84875 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success
1620139838.84875 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1620139838.84875 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1620139838.87975 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00472000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates hidden or system file (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119653.369662 SetFileAttributesW	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01c4468f12ec9c8840f39d36ae80e9ba.exe filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01c4468f12ec9c8840f39d36ae80e9ba.exe	success	1	0

Creates a suspicious process (2 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF009.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE385.tmp"

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620139840.48875 CreateProcessInternalW	thread_identifier: 2168 thread_handle: 0x00000218 process_identifier: 1244 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE385.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x0000021c inherit_handles: 1	success	1	0
1620139843.50475 CreateProcessInternalW	thread_identifier: 2576 thread_handle: 0x00000218 process_identifier: 2940 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF009.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000290 inherit_handles: 1	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.467433722431013

section

{'size_of_data': '0x00079800', 'virtual_address': '0x00002000', 'entropy': 7.467433722431013, 'name': '.text', 'virtual_size': '0x00079654'}

description

A section with a high entropy has been found

entropy

0.9538763493621197

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119623.119662 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1620139845.39575 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF009.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE385.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	185.19.85.177

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119655.025662 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000022c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Attempts to identify installed AV products by installation directory (11 个事件)

file	C:\Program Files\AVAST Software\Avast\avastUI.exe
file	C:\Program Files (x86)\AVAST Software\Avast\avastUI.exe
file	C:\Program Files\AVAST Software
file	C:\Program Files (x86)\AVAST Software
file	C:\Program Files\Kaspersky Lab
file	C:\Program Files (x86)\Kaspersky Lab
file	C:\Program Files\McAfee\Agent
file	C:\Program Files\Trend Micro
file	C:\Program Files (x86)\Trend Micro
file	C:\Program Files\AVG\Antivirus\AVGUI.exe
file	C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620139845.92675 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

01c4468f12ec9c8840f39d36ae80e9ba.exe tried to sleep 5456432 seconds, actually delayed analysis time by 5456432 seconds

Installs itself for autorun at Windows startup (2 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ampampamp				reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\ampampamp.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service				reg_value	C:\Program Files (x86)\DSL Service\dslsvc.exe

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1620119655.025662 WriteProcessMemory	process_identifier: 2976 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ð_ H.textÇ È `.relocÊ@B.rsrcÐ_ `Ì@@ process_handle: 0x0000022c base_address: 0x00400000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: à7 process_handle: 0x0000022c base_address: 0x00420000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: @ process_handle: 0x0000022c base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119655.025662 WriteProcessMemory	process_identifier: 2976 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ð_ H.textÇ È `.relocÊ@B.rsrcÐ_ `Ì@@ process_handle: 0x0000022c base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2272 called NtSetContextThread to modify thread in remote process 2976
1620119655.041662 NtSetContextThread	thread_handle: 0x00000224 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01c4468f12ec9c8840f39d36ae80e9ba.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2272 resumed a thread in remote process 2976
1620119655.572662 NtResumeThread	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2976	success	0	0

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1620119620.963662 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2272	success	0
1620119620.978662 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2272	success	0
1620119655.025662 CreateProcessInternalW	thread_identifier: 2296 thread_handle: 0x00000224 process_identifier: 2976 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01c4468f12ec9c8840f39d36ae80e9ba.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01c4468f12ec9c8840f39d36ae80e9ba.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x0000022c inherit_handles: 0	success	1
1620119655.025662 NtGetContextThread	thread_handle: 0x00000224	success	0
1620119655.025662 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000022c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1620119655.025662 WriteProcessMemory	process_identifier: 2976 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ð_ H.textÇ È `.relocÊ@B.rsrcÐ_ `Ì@@ process_handle: 0x0000022c base_address: 0x00400000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: process_handle: 0x0000022c base_address: 0x00402000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: à7 process_handle: 0x0000022c base_address: 0x00420000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: process_handle: 0x0000022c base_address: 0x00422000	success	1
1620119655.041662 WriteProcessMemory	process_identifier: 2976 buffer: @ process_handle: 0x0000022c base_address: 0x7efde008	success	1
1620119655.041662 NtSetContextThread	thread_handle: 0x00000224 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0
1620119655.572662 NtResumeThread	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2976	success	0
1620139838.84875 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2976	success	0
1620139838.86375 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2976	success	0
1620139840.48875 CreateProcessInternalW	thread_identifier: 2168 thread_handle: 0x00000218 process_identifier: 1244 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE385.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x0000021c inherit_handles: 1	success	1
1620139843.50475 CreateProcessInternalW	thread_identifier: 2576 thread_handle: 0x00000218 process_identifier: 2940 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF009.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000290 inherit_handles: 1	success	1
1620139845.19275 NtResumeThread	thread_handle: 0x000002b0 suspend_count: 1 process_identifier: 2976	success	0
1620139845.27075 NtResumeThread	thread_handle: 0x000002e0 suspend_count: 1 process_identifier: 2976	success	0
1620139845.41075 NtResumeThread	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 2976	success	0
1620139846.56775 NtResumeThread	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2976	success	0
1620139846.92675 NtResumeThread	thread_handle: 0x00000350 suspend_count: 1 process_identifier: 2976	success	0
1620139848.84875 NtResumeThread	thread_handle: 0x00000368 suspend_count: 1 process_identifier: 2976	success	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43758143
McAfee	GenericRXLV-UT!01C4468F12EC
Cylance	Unsafe
Zillya	Backdoor.NanoBot.Win32.9
K7AntiVirus	Trojan ( 0056d8fc1 )
Alibaba	Backdoor:MSIL/Injector.9674b1c1
K7GW	Trojan ( 0056d8fc1 )
Cybereason	malicious.78b185
TrendMicro	TROJ_GEN.R03AC0WI220
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.VCJ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.NanoBot.gen
BitDefender	Trojan.GenericKD.43758143
Avast	Win32:Trojan-gen
Tencent	Msil.Backdoor.Nanobot.Eye
Ad-Aware	Trojan.GenericKD.43758143
F-Secure	Trojan.TR/AD.Nanocore.mhwyg
DrWeb	Trojan.DownLoader34.31643
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
FireEye	Generic.mg.01c4468f12ec9c88
Sophos	Mal/Generic-S
Ikarus	not-a-virus:Hacktool.ICBypass
GData	MSIL.Backdoor.Nancat.5H0ISD
Avira	TR/AD.Nanocore.mhwyg
Antiy-AVL	Trojan[Backdoor]/MSIL.NanoBot
Arcabit	Trojan.Generic.D29BB23F
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Backdoor.MSIL.NanoBot.gen
Microsoft	Trojan:Win32/Woreflint.A!cl
AhnLab-V3	Malware/Win32.Generic.C4190216
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.GenericKD.43758143
MAX	malware (ai score=89)
Malwarebytes	Backdoor.NanoCore
TrendMicro-HouseCall	TROJ_GEN.R03AC0WI220
SentinelOne	DFI - Malicious PE
Fortinet	Riskware/NanoBot
BitDefenderTheta	Gen:NN.ZemsilF.34216.Fm0@auhscI
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_80% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	192.168.56.101:49189
dead_host	185.19.85.177:54085
dead_host	192.168.56.101:49190
dead_host	192.168.56.101:49187

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 16:29:54

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
napymon81.dyndns.org
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	51808	8.8.4.4	53
192.168.56.101	58367	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.