SmartHawk

8.0

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

dfe001ed1950d612ea59a75c6367629ff0e031853e9f7a12b7f0381a4f20660f

22534e74fe59355654542d03485f4e43.exe

分析耗时

76s

最近分析

文件大小

671.5KB

静态报毒动态报毒 AGENTTESLA AI SCORE=84 AVSARHER BSK66A CONFIDENCE ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HOOH HTSETD INJECT3 IYPRL KRYPTIK LOKIBOT MALICIOUS PE MALWARE@#3U4QSTT16EYO8 MALWAREX PM0@AUSWHWD R349444 SCORE TASKUN TSCOPE UNSAFE USXVPHS20 WACATAC ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FYV!22534E74FE59	20200929	6.0.6.653
Alibaba	Trojan:MSIL/AgentTesla.2750a7d4	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Tencent	Msil.Trojan.Taskun.Hooh	20200930	1.0.0.1
Kingsoft		20200930	2013.8.14.323

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619273309.019124 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619273310.003124 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269223.600269 IsDebuggerPresent		failed	0	0
1619269223.600269 IsDebuggerPresent		failed	0	0
1619269270.522269 IsDebuggerPresent		failed	0	0
1619269271.038269 IsDebuggerPresent		failed	0	0
1619273296.800124 IsDebuggerPresent		failed	0	0
1619273296.800124 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269223.631269 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 171 个事件)

Time & API	Arguments	Status	Return
1619269222.991269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00940000	success	0
1619269222.991269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ae0000	success	0
1619269223.319269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005b0000	success	0
1619269223.319269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success	0
1619269223.460269 NtProtectVirtualMemory	process_identifier: 880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1619269223.600269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f20000	success	0
1619269223.600269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fb0000	success	0
1619269223.600269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0060a000	success	0
1619269223.616269 NtProtectVirtualMemory	process_identifier: 880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1619269223.616269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00602000	success	0
1619269223.788269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00612000	success	0
1619269223.866269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00635000	success	0
1619269223.866269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0063b000	success	0
1619269223.866269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00637000	success	0
1619269223.928269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00613000	success	0
1619269223.960269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061c000	success	0
1619269224.288269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00614000	success	0
1619269224.303269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00616000	success	0
1619269224.381269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f20000	success	0
1619269224.428269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0062a000	success	0
1619269224.428269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00627000	success	0
1619269224.569269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00617000	success	0
1619269224.569269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00618000	success	0
1619269224.585269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00619000	success	0
1619269224.647269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00626000	success	0
1619269224.678269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f21000	success	0
1619269225.069269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f22000	success	0
1619269225.147269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f50000	success	0
1619269225.600269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f51000	success	0
1619269225.725269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x042b0000	success	0
1619269225.725269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061a000	success	0
1619269225.803269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f52000	success	0
1619269258.866269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b1000	success	0
1619269259.053269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0060c000	success	0
1619269259.053269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f23000	success	0
1619269259.116269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f53000	success	0
1619269259.163269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f54000	success	0
1619269259.194269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f55000	success	0
1619269259.225269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f56000	success	0
1619269259.272269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f24000	success	0
1619269259.272269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061d000	success	0
1619269259.272269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f57000	success	0
1619269259.288269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f25000	success	0
1619269259.303269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f28000	success	0
1619269259.335269 NtProtectVirtualMemory	process_identifier: 880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 526336 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05710400	failed	3221225550
1619269269.647269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f29000	success	0
1619269269.663269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f2a000	success	0
1619269269.663269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f58000	success	0
1619269269.694269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f2b000	success	0
1619269269.725269 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f2c000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.976948186632

section

{'size_of_data': '0x000a7400', 'virtual_address': '0x00002000', 'entropy': 7.976948186632, 'name': '.text', 'virtual_size': '0x000a73a4'}

description

A section with a high entropy has been found

entropy

0.9970193740685543

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269259.319269 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619273308.675124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269270.803269 NtAllocateVirtualMemory	process_identifier: 2604 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000020c4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619269270.803269 WriteProcessMemory	process_identifier: 2604 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELád9_àì® @ `@T W @ H.text´ê ì `.rsrc î@@.reloc@ò@B process_handle: 0x000020c4 base_address: 0x00400000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: 0HX ¼¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion0.0.0.0t)InternalNameWczopHJmPDJfgxghZnBtWOyWbTaMXyGlFRxs.exe(LegalCopyright \|)OriginalFilenameWczopHJmPDJfgxghZnBtWOyWbTaMXyGlFRxs.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x000020c4 base_address: 0x00462000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: °: process_handle: 0x000020c4 base_address: 0x00464000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: @ process_handle: 0x000020c4 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619269270.803269 WriteProcessMemory	process_identifier: 2604 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELád9_àì® @ `@T W @ H.text´ê ì `.rsrc î@@.reloc@ò@B process_handle: 0x000020c4 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 880 called NtSetContextThread to modify thread in remote process 2604
1619269270.819269 NtSetContextThread	thread_handle: 0x000009c0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4590254 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2604	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 880 resumed a thread in remote process 2604
1619269271.069269 NtResumeThread	thread_handle: 0x000009c0 suspend_count: 1 process_identifier: 2604	success	0	0

Executed a process and injected code into it, probably while unpacking (24 个事件)

Time & API	Arguments	Status	Return
1619269223.600269 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 880	success	0
1619269223.616269 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 880	success	0
1619269223.647269 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 880	success	0
1619269270.506269 NtResumeThread	thread_handle: 0x0000b1d4 suspend_count: 1 process_identifier: 880	success	0
1619269270.506269 NtResumeThread	thread_handle: 0x00009ba4 suspend_count: 1 process_identifier: 880	success	0
1619269270.803269 CreateProcessInternalW	thread_identifier: 2964 thread_handle: 0x000009c0 process_identifier: 2604 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\22534e74fe59355654542d03485f4e43.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\22534e74fe59355654542d03485f4e43.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000020c4 inherit_handles: 0	success	1
1619269270.803269 NtGetContextThread	thread_handle: 0x000009c0	success	0
1619269270.803269 NtAllocateVirtualMemory	process_identifier: 2604 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000020c4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619269270.803269 WriteProcessMemory	process_identifier: 2604 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELád9_àì® @ `@T W @ H.text´ê ì `.rsrc î@@.reloc@ò@B process_handle: 0x000020c4 base_address: 0x00400000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: process_handle: 0x000020c4 base_address: 0x00402000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: 0HX ¼¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion0.0.0.0t)InternalNameWczopHJmPDJfgxghZnBtWOyWbTaMXyGlFRxs.exe(LegalCopyright \|)OriginalFilenameWczopHJmPDJfgxghZnBtWOyWbTaMXyGlFRxs.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x000020c4 base_address: 0x00462000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: °: process_handle: 0x000020c4 base_address: 0x00464000	success	1
1619269270.819269 WriteProcessMemory	process_identifier: 2604 buffer: @ process_handle: 0x000020c4 base_address: 0x7efde008	success	1
1619269270.819269 NtSetContextThread	thread_handle: 0x000009c0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4590254 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2604	success	0
1619269271.069269 NtResumeThread	thread_handle: 0x000009c0 suspend_count: 1 process_identifier: 2604	success	0
1619269271.069269 NtResumeThread	thread_handle: 0x0000c970 suspend_count: 1 process_identifier: 880	success	0
1619269271.085269 NtGetContextThread	thread_handle: 0x0000c970	success	0
1619269271.085269 NtGetContextThread	thread_handle: 0x0000c970	success	0
1619269271.085269 NtResumeThread	thread_handle: 0x0000c970 suspend_count: 1 process_identifier: 880	success	0
1619273296.800124 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2604	success	0
1619273296.831124 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2604	success	0
1619273296.878124 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2604	success	0
1619273309.816124 NtResumeThread	thread_handle: 0x000002e0 suspend_count: 1 process_identifier: 2604	success	0
1619273309.863124 NtResumeThread	thread_handle: 0x00000310 suspend_count: 1 process_identifier: 2604	success	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34436328
FireEye	Generic.mg.22534e74fe593556
CAT-QuickHeal	Trojan.Multi
McAfee	Fareit-FYV!22534E74FE59
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2473964
Sangfor	Malware
K7AntiVirus	Trojan ( 0056d6c41 )
Alibaba	Trojan:MSIL/AgentTesla.2750a7d4
K7GW	Trojan ( 0056d6c41 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D20D74E8
Invincea	Mal/Generic-S
Cyren	W32/MSIL_Kryptik.BLW.gen!Eldorado
Symantec	Packed.Generic.570
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
BitDefender	Trojan.GenericKD.34436328
NANO-Antivirus	Trojan.Win32.Taskun.htsetd
ViRobot	Trojan.Win32.Z.Kryptik.687616.F
Tencent	Msil.Trojan.Taskun.Hooh
Ad-Aware	Trojan.GenericKD.34436328
Emsisoft	Trojan.Crypt (A)
Comodo	Malware@#3u4qstt16eyo8
F-Secure	Trojan.TR/Kryptik.iyprl
DrWeb	Trojan.Inject3.53454
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.MSIL.WACATAC.USXVPHS20
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Avira	TR/Kryptik.iyprl
MAX	malware (ai score=84)
Microsoft	Trojan:MSIL/AgentTesla.PBG!MTB
AegisLab	Trojan.MSIL.Taskun.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Taskun.gen
GData	Trojan.GenericKD.34436328
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Lokibot.R349444
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.GenericKD.34436328
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.XMX
TrendMicro-HouseCall	Trojan.MSIL.WACATAC.USXVPHS20
Yandex	Trojan.AvsArher.bSK66A
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.XMH!tr
BitDefenderTheta	Gen:NN.ZemsilF.34254.Pm0@ausWhWd

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-28 09:18:45

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.