13.4
0-day
54 个模型检测该样本为恶意！
重新分析
更多

4d2df79602d8708d9513cd045037c4e627ac3430f9efc56a7f5876d303e376ef

1b9badbfdcca3999a1b073395adfb960.exe

分析耗时

77s

最近分析

文件大小

764.4KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=80 AQHU ATTRIBUTE BUPS8W CLOUD CONFIDENCE EANZ FALSESIGN FAREIT FXYC GDSDA HGIASOGA HIGH CONFIDENCE HIGHCONFIDENCE HWDBYQ IGENT KCLOUD KILLPROC2 KRYPTIK MALWARE@#17TEGUIBJV8NW MSILPERSEUS NANOBOT NANOCORE SAVE SCORE SUSGEN TSCOPE UNSAFE WHNRI YMACCO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FZR!1B9BADBFDCCA 20210217 6.0.6.653
Alibaba Backdoor:MSIL/Ymacco.d949b527 20190527 0.3.0.5
Avast Win32:Malware-gen 20210217 21.1.5827.0
Tencent Win32.Trojan.Falsesign.Eanz 20210217 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft Win32.Hack.Undef.(kcloud) 20210217 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1620119614.606176
IsDebuggerPresent
failed 0 0
1620119614.606176
IsDebuggerPresent
failed 0 0
1620120087.898001
IsDebuggerPresent
failed 0 0
1620120087.913001
IsDebuggerPresent
failed 0 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620119614.637176
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Connects to a Dynamic DNS Domain (1 个事件)
domain vreme.ddns.net
Allocates read-write-execute memory (usually to unpack itself) (50 out of 208 个事件)
Time & API Arguments Status Return Repeated
1620119613.872176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750a1000
success 0 0
1620119613.934176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00610000
success 0 0
1620119613.934176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006d0000
success 0 0
1620119614.387176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1620119614.387176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74fc1000
success 0 0
1620119614.434176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00880000
success 0 0
1620119614.434176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00a40000
success 0 0
1620119614.543176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1620119614.606176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00880000
success 0 0
1620119614.606176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00910000
success 0 0
1620119614.622176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1620119614.622176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1620119614.622176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1620119614.778176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00532000
success 0 0
1620119614.825176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00555000
success 0 0
1620119614.840176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055b000
success 0 0
1620119614.840176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00557000
success 0 0
1620119614.872176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75091000
success 0 0
1620119614.918176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00533000
success 0 0
1620119614.950176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053c000
success 0 0
1620119614.981176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00710000
success 0 0
1620119615.090176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00534000
success 0 0
1620119615.090176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00535000
success 0 0
1620119615.122176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74fa1000
success 0 0
1620119615.200176
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1620119615.465176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00536000
success 0 0
1620119615.512176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00537000
success 0 0
1620119615.528176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00538000
success 0 0
1620119615.543176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00546000
success 0 0
1620119615.543176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00711000
success 0 0
1620119615.559176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0054a000
success 0 0
1620119615.559176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00547000
success 0 0
1620119615.637176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00712000
success 0 0
1620119615.668176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00713000
success 0 0
1620119615.700176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00539000
success 0 0
1620119615.700176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052c000
success 0 0
1620119615.700176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00714000
success 0 0
1620119615.731176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00717000
success 0 0
1620119616.778176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00718000
success 0 0
1620119616.825176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00730000
success 0 0
1620119616.825176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00719000
success 0 0
1620119616.872176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00731000
success 0 0
1620119616.872176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053d000
success 0 0
1620119616.887176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00732000
success 0 0
1620119616.903176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0071a000
success 0 0
1620119617.075176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00733000
success 0 0
1620119617.106176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0071b000
success 0 0
1620119617.231176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0071c000
success 0 0
1620119618.262176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0071d000
success 0 0
1620119618.293176
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00735000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.962060206220631 section {'size_of_data': '0x000ad200', 'virtual_address': '0x00002000', 'entropy': 7.962060206220631, 'name': '.text', 'virtual_size': '0x000ad0f4'} description A section with a high entropy has been found
entropy 0.9123847167325428 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1620119617.200176
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620120090.179001
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (2 个事件)
Time & API Arguments Status Return Repeated
1620119617.950176
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1436
process_handle: 0x0000026c
failed 0 0
1620119617.950176
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1436
process_handle: 0x0000026c
success 0 0
网络通信
One or more of the buffers contains an embedded PE file (5 个事件)
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.244.30.251
Allocates execute permission to another process indicative of possible code injection (2 个事件)
Time & API Arguments Status Return Repeated
1620119617.497176
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000264
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1620119618.028176
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000268
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Looks for the Windows Idle Time to determine the uptime (1 个事件)
Time & API Arguments Status Return Repeated
1620120090.632001
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description RegSvcs.exe tried to sleep 5456522 seconds, actually delayed analysis time by 5456522 seconds
Manipulates memory of a non-child process indicative of process injection (2 个事件)
Process injection Process 1380 manipulating memory of non-child process 1436
Time & API Arguments Status Return Repeated
1620119617.497176
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000264
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Potential code injection by writing to the memory of another process (3 个事件)
Time & API Arguments Status Return Repeated
1620119618.028176
WriteProcessMemory
process_identifier: 2760
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èê’ç @  8çW ”æ  H.text˜Ç È `.reloc Ê@B.rsrc”æ èÌ@@
process_handle: 0x00000268
base_address: 0x00400000
success 1 0
1620119618.043176
WriteProcessMemory
process_identifier: 2760
buffer: à ”7
process_handle: 0x00000268
base_address: 0x00420000
success 1 0
1620119618.043176
WriteProcessMemory
process_identifier: 2760
buffer: @
process_handle: 0x00000268
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1620119618.028176
WriteProcessMemory
process_identifier: 2760
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èê’ç @  8çW ”æ  H.text˜Ç È `.reloc Ê@B.rsrc”æ èÌ@@
process_handle: 0x00000268
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1380 called NtSetContextThread to modify thread in remote process 2760
Time & API Arguments Status Return Repeated
1620119618.043176
NtSetContextThread
thread_handle: 0x0000026c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2760
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1380 resumed a thread in remote process 2760
Time & API Arguments Status Return Repeated
1620119618.247176
NtResumeThread
thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 2760
success 0 0
Executed a process and injected code into it, probably while unpacking (29 个事件)
Time & API Arguments Status Return Repeated
1620119614.606176
NtResumeThread
thread_handle: 0x0000016c
suspend_count: 1
process_identifier: 1380
success 0 0
1620119614.622176
NtResumeThread
thread_handle: 0x000001b8
suspend_count: 1
process_identifier: 1380
success 0 0
1620119614.653176
NtResumeThread
thread_handle: 0x000001fc
suspend_count: 1
process_identifier: 1380
success 0 0
1620119617.497176
CreateProcessInternalW
thread_identifier: 368
thread_handle: 0x00000260
process_identifier: 1436
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000264
inherit_handles: 0
success 1 0
1620119617.497176
NtGetContextThread
thread_handle: 0x00000260
success 0 0
1620119617.497176
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000264
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1620119618.028176
CreateProcessInternalW
thread_identifier: 2544
thread_handle: 0x0000026c
process_identifier: 2760
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000268
inherit_handles: 0
success 1 0
1620119618.028176
NtGetContextThread
thread_handle: 0x0000026c
success 0 0
1620119618.028176
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000268
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1620119618.028176
WriteProcessMemory
process_identifier: 2760
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èê’ç @  8çW ”æ  H.text˜Ç È `.reloc Ê@B.rsrc”æ èÌ@@
process_handle: 0x00000268
base_address: 0x00400000
success 1 0
1620119618.028176
WriteProcessMemory
process_identifier: 2760
buffer:
process_handle: 0x00000268
base_address: 0x00402000
success 1 0
1620119618.043176
WriteProcessMemory
process_identifier: 2760
buffer: à ”7
process_handle: 0x00000268
base_address: 0x00420000
success 1 0
1620119618.043176
WriteProcessMemory
process_identifier: 2760
buffer:
process_handle: 0x00000268
base_address: 0x00422000
success 1 0
1620119618.043176
WriteProcessMemory
process_identifier: 2760
buffer: @
process_handle: 0x00000268
base_address: 0x7efde008
success 1 0
1620119618.043176
NtSetContextThread
thread_handle: 0x0000026c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2760
success 0 0
1620119618.247176
NtResumeThread
thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 2760
success 0 0
1620120087.913001
NtResumeThread
thread_handle: 0x0000016c
suspend_count: 1
process_identifier: 2760
success 0 0
1620120087.929001
NtResumeThread
thread_handle: 0x000001bc
suspend_count: 1
process_identifier: 2760
success 0 0
1620120087.976001
NtResumeThread
thread_handle: 0x00000204
suspend_count: 1
process_identifier: 2760
success 0 0
1620120089.835001
NtResumeThread
thread_handle: 0x000002bc
suspend_count: 1
process_identifier: 2760
success 0 0
1620120089.851001
NtResumeThread
thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 2760
success 0 0
1620120090.117001
NtResumeThread
thread_handle: 0x000002f8
suspend_count: 1
process_identifier: 2760
success 0 0
1620120090.351001
NtResumeThread
thread_handle: 0x0000031c
suspend_count: 1
process_identifier: 2760
success 0 0
1620120091.054001
NtResumeThread
thread_handle: 0x00000398
suspend_count: 1
process_identifier: 2760
success 0 0
1620120091.070001
NtResumeThread
thread_handle: 0x000003ac
suspend_count: 1
process_identifier: 2760
success 0 0
1620120092.617001
NtResumeThread
thread_handle: 0x000003c4
suspend_count: 1
process_identifier: 2760
success 0 0
1620120102.257001
NtResumeThread
thread_handle: 0x000003dc
suspend_count: 1
process_identifier: 2760
success 0 0
1620120112.054001
NtResumeThread
thread_handle: 0x000003fc
suspend_count: 1
process_identifier: 2760
success 0 0
1620120131.007001
NtResumeThread
thread_handle: 0x0000042c
suspend_count: 1
process_identifier: 2760
success 0 0
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.KillProc2.11549
MicroWorld-eScan Gen:Variant.MSILPerseus.233048
CAT-QuickHeal Backdoor.MSIL
McAfee Fareit-FZR!1B9BADBFDCCA
Cylance Unsafe
Zillya Trojan.NanoCore.Win32.6885
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Backdoor:MSIL/Ymacco.d949b527
K7GW Riskware ( 0040eff71 )
Cybereason malicious.fdcca3
Arcabit Trojan.MSILPerseus.D38E58
Cyren W32/Trojan.FXYC-5391
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Backdoor.MSIL.NanoBot.gen
BitDefender Gen:Variant.MSILPerseus.233048
NANO-Antivirus Trojan.Win32.NanoBot.hwdbyq
Paloalto generic.ml
Tencent Win32.Trojan.Falsesign.Eanz
Ad-Aware Gen:Variant.MSILPerseus.233048
Sophos Mal/Generic-S
Comodo Malware@#17teguibjv8nw
F-Secure Trojan.TR/AD.Nanocore.whnri
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition Fareit-FZR!1B9BADBFDCCA
FireEye Gen:Variant.MSILPerseus.233048
Emsisoft Gen:Variant.MSILPerseus.233048 (B)
Jiangmin Trojan.PSW.MSIL.aqhu
Avira TR/AD.Nanocore.whnri
Antiy-AVL Trojan[Backdoor]/MSIL.NanoBot
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/AgentTesla!ml
ZoneAlarm HEUR:Backdoor.MSIL.NanoBot.gen
GData Gen:Variant.MSILPerseus.233048
Cynet Malicious (score: 100)
VBA32 TScope.Trojan.MSIL
ALYac Backdoor.RAT.MSIL.NanoCore
MAX malware (ai score=80)
Malwarebytes Trojan.Crypt
Zoner Trojan.Win32.93793
ESET-NOD32 MSIL/NanoCore.E
Rising Backdoor.Nanocore!8.F894 (CLOUD)
Yandex Trojan.Igent.bUpS8w.50
Ikarus Trojan.MSIL.Agent
eGambit Generic.Malware
Fortinet MSIL/Kryptik.XQT!tr
MaxSecure Trojan.Malware.73691366.susgen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)
dead_host 192.168.56.101:49192
dead_host 192.168.56.101:49189
dead_host 185.244.30.251:1012
dead_host 192.168.56.101:49183
dead_host 192.168.56.101:49185
dead_host 192.168.56.101:49184
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2064-06-24 13:24:07

Imports

Library mscoree.dll:
• 0x10002000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 51378 8.8.8.8 53
192.168.56.101 51808 8.8.8.8 53
192.168.56.101 53237 8.8.8.8 53
192.168.56.101 53657 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.