7.0
高危
55 个模型检测该样本为恶意！
重新分析
更多

1faba4e3aa2465396894cc4b71f97f0b50c593245bd03421db8e4e996e9c3159

2366eb7e94fe095e52cf3961acd15934.exe

分析耗时

94s

最近分析

文件大小

719.0KB
静态报毒 动态报毒 100% AI SCORE=81 ALI2000015 BTA8X9 CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO ELKP ELOL FAREIT FORMBOOK GDSDA HIGH CONFIDENCE HPIC IGENT KRYPTIK MALWARE@#165PXS24MWHVV QVM05 R + MAL R06EC0DI220 RJQQP SCORE STATIC AI SUSPICIOUS PE TSCOPE UNSAFE X2059 XPACK 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FSK!2366EB7E94FE 20201228 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201228 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Hpic 20201228 1.0.0.1
Kingsoft 20201228 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (12 个事件)
Time & API Arguments Status Return Repeated
1619297067.41825
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48824128
registers.edi: 0
registers.eax: 0
registers.ebp: 48824200
registers.edx: 33351864
registers.ebx: 0
registers.esi: 0
registers.ecx: 3296526336
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297069.73
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
2366eb7e94fe095e52cf3961acd15934+0x40a4d @ 0x440a4d
2366eb7e94fe095e52cf3961acd15934+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd9414ad
success 0 0
1619297068.932626
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 33685312
registers.edi: 0
registers.eax: 0
registers.ebp: 33685384
registers.edx: 32630968
registers.ebx: 0
registers.esi: 0
registers.ecx: 3454009344
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297079.557626
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49872704
registers.edi: 0
registers.eax: 0
registers.ebp: 49872776
registers.edx: 5302456
registers.ebx: 0
registers.esi: 0
registers.ecx: 349437952
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297083.729626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
2366eb7e94fe095e52cf3961acd15934+0x40a4d @ 0x440a4d
2366eb7e94fe095e52cf3961acd15934+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4814ad
success 0 0
1619297083.182375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799424
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 32958648
registers.ebx: 0
registers.esi: 0
registers.ecx: 37879808
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297089.26125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49020736
registers.edi: 0
registers.eax: 0
registers.ebp: 49020808
registers.edx: 6351032
registers.ebx: 0
registers.esi: 0
registers.ecx: 998440960
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297091.276375
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
2366eb7e94fe095e52cf3961acd15934+0x40a4d @ 0x440a4d
2366eb7e94fe095e52cf3961acd15934+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda714ad
success 0 0
1619297092.667375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49348416
registers.edi: 0
registers.eax: 0
registers.ebp: 49348488
registers.edx: 8317112
registers.ebx: 0
registers.esi: 0
registers.ecx: 656146432
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297097.324125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 33685312
registers.edi: 0
registers.eax: 0
registers.ebp: 33685384
registers.edx: 32630968
registers.ebx: 0
registers.esi: 0
registers.ecx: 1485111296
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619297100.54275
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750be97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750bea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750bb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750bb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750bac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750baed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750b5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750b559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
2366eb7e94fe095e52cf3961acd15934+0x40a4d @ 0x440a4d
2366eb7e94fe095e52cf3961acd15934+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4e14ad
success 0 0
1619297101.229501
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151808
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 33089720
registers.ebx: 0
registers.esi: 0
registers.ecx: 1187840000
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 2366eb7e94fe095e52cf3961acd15934+0x5eae4
exception.instruction: div eax
exception.module: 2366eb7e94fe095e52cf3961acd15934.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 132 个事件)
Time & API Arguments Status Return Repeated
1619297067.19925
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619297067.41825
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00620000
success 0 0
1619297067.43325
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619297068.605
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619297068.621
NtAllocateVirtualMemory
process_identifier: 784
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00690000
success 0 0
1619297068.621
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b0000
success 0 0
1619297068.621
NtAllocateVirtualMemory
process_identifier: 784
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004c0000
success 0 0
1619297068.621
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c2000
success 0 0
1619297068.98
NtAllocateVirtualMemory
process_identifier: 784
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00690000
success 0 0
1619297068.98
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006f0000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003e2000
success 0 0
1619297069.715
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297068.885626
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00590000
success 0 0
1619297068.932626
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02070000
success 0 0
1619297068.948626
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020c0000
success 0 0
1619297079.417626
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619297079.557626
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1619297079.589626
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01dd0000
success 0 0
1619297082.479626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619297082.495626
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01db0000
success 0 0
1619297082.495626
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e30000
success 0 0
1619297082.495626
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004c0000
success 0 0
1619297082.495626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c2000
success 0 0
1619297082.526626
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e70000
success 0 0
1619297082.526626
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ec0000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619297082.885626
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (15 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.549693793680028 section {'size_of_data': '0x0000cc00', 'virtual_address': '0x0005f000', 'entropy': 7.549693793680028, 'name': 'DATA', 'virtual_size': '0x0000ca2c'} description A section with a high entropy has been found
entropy 7.299491500189568 section {'size_of_data': '0x0003f200', 'virtual_address': '0x0007b000', 'entropy': 7.299491500189568, 'name': '.rsrc', 'virtual_size': '0x0003f07c'} description A section with a high entropy has been found
entropy 0.42270194986072424 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process 2366eb7e94fe095e52cf3961acd15934.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (8 个事件)
Time & API Arguments Status Return Repeated
1619297067.46525
Process32NextW
process_name: 2366eb7e94fe095e52cf3961acd15934.exe
snapshot_handle: 0x000000fc
process_identifier: 2236
failed 0 0
1619297078.839626
Process32NextW
process_name: 2366eb7e94fe095e52cf3961acd15934.exe
snapshot_handle: 0x00000234
process_identifier: 2860
failed 0 0
1619297079.604626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 1804
failed 0 0
1619297088.057375
Process32NextW
process_name: 2366eb7e94fe095e52cf3961acd15934.exe
snapshot_handle: 0x00000160
process_identifier: 1272
failed 0 0
1619297089.29325
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 3056
failed 0 0
1619297096.057375
Process32NextW
process_name: 2366eb7e94fe095e52cf3961acd15934.exe
snapshot_handle: 0x00000158
process_identifier: 2964
failed 0 0
1619297097.324125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 2448
failed 0 0
1619297136.370501
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x000004cc
process_identifier: 3468
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (8 个事件)
Process injection Process 2236 called NtSetContextThread to modify thread in remote process 784
Process injection Process 2080 called NtSetContextThread to modify thread in remote process 1880
Process injection Process 1940 called NtSetContextThread to modify thread in remote process 2364
Process injection Process 2952 called NtSetContextThread to modify thread in remote process 1824
Time & API Arguments Status Return Repeated
1619297067.98025
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 784
success 0 0
1619297080.620626
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1880
success 0 0
1619297089.91825
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
1619297098.527125
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1824
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (8 个事件)
Process injection Process 2236 resumed a thread in remote process 784
Process injection Process 2080 resumed a thread in remote process 1880
Process injection Process 1940 resumed a thread in remote process 2364
Process injection Process 2952 resumed a thread in remote process 1824
Time & API Arguments Status Return Repeated
1619297068.37125
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 784
success 0 0
1619297082.260626
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1880
success 0 0
1619297090.52725
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2364
success 0 0
1619297099.605125
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1824
success 0 0
Executed a process and injected code into it, probably while unpacking (32 个事件)
Time & API Arguments Status Return Repeated
1619297067.93325
CreateProcessInternalW
thread_identifier: 520
thread_handle: 0x00000100
process_identifier: 784
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619297067.93325
NtUnmapViewOfSection
process_identifier: 784
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619297067.93325
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 784
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619297067.98025
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619297067.98025
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 784
success 0 0
1619297068.37125
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 784
success 0 0
1619297068.49625
CreateProcessInternalW
thread_identifier: 192
thread_handle: 0x00000108
process_identifier: 2860
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe" 2 784 28889156
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619297079.010626
CreateProcessInternalW
thread_identifier: 2344
thread_handle: 0x00000238
process_identifier: 2080
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000023c
inherit_handles: 0
success 1 0
1619297080.479626
CreateProcessInternalW
thread_identifier: 1908
thread_handle: 0x00000100
process_identifier: 1880
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619297080.479626
NtUnmapViewOfSection
process_identifier: 1880
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619297080.510626
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 1880
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619297080.604626
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619297080.620626
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1880
success 0 0
1619297082.260626
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1880
success 0 0
1619297082.448626
CreateProcessInternalW
thread_identifier: 1824
thread_handle: 0x00000108
process_identifier: 1272
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe" 2 1880 28903046
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619297088.385375
CreateProcessInternalW
thread_identifier: 1916
thread_handle: 0x00000164
process_identifier: 1940
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000168
inherit_handles: 0
success 1 0
1619297089.87125
CreateProcessInternalW
thread_identifier: 2344
thread_handle: 0x00000100
process_identifier: 2364
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619297089.87125
NtUnmapViewOfSection
process_identifier: 2364
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619297089.87125
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2364
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619297089.91825
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619297089.91825
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
1619297090.52725
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2364
success 0 0
1619297091.35525
CreateProcessInternalW
thread_identifier: 2968
thread_handle: 0x00000108
process_identifier: 2964
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe" 2 2364 28911312
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619297096.339375
CreateProcessInternalW
thread_identifier: 2948
thread_handle: 0x0000015c
process_identifier: 2952
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000160
inherit_handles: 0
success 1 0
1619297098.386125
CreateProcessInternalW
thread_identifier: 2412
thread_handle: 0x00000100
process_identifier: 1824
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619297098.386125
NtUnmapViewOfSection
process_identifier: 1824
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619297098.402125
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 1824
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619297098.527125
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619297098.527125
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1824
success 0 0
1619297099.605125
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1824
success 0 0
1619297099.980125
CreateProcessInternalW
thread_identifier: 3092
thread_handle: 0x00000108
process_identifier: 3088
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe" 2 1824 28920390
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619297136.542501
CreateProcessInternalW
thread_identifier: 3648
thread_handle: 0x000004d0
process_identifier: 3644
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2366eb7e94fe095e52cf3961acd15934.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000004d4
inherit_handles: 0
success 1 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.13
FireEye Generic.mg.2366eb7e94fe095e
CAT-QuickHeal Trojan.Kryptik
Qihoo-360 Generic/HEUR/QVM05.1.B5ED.Malware.Gen
McAfee Fareit-FSK!2366EB7E94FE
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005651801 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 005651801 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.13
Cyren W32/Agent.BSS.gen!Eldorado
Symantec Trojan.Gen.2
TrendMicro-HouseCall TROJ_GEN.R06EC0DI220
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.13
Paloalto generic.ml
AegisLab Trojan.Win32.Malicious.4!c
Tencent Win32.Trojan.Kryptik.Hpic
Ad-Aware Trojan.Delf.FareIt.Gen.13
TACHYON Trojan/W32.DP-Agent.736256.L
Emsisoft Trojan.Delf.FareIt.Gen.13 (B)
Comodo Malware@#165pxs24mwhvv
TrendMicro TROJ_GEN.R06EC0DI220
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-R + Mal/Fareit-AA
SentinelOne Static AI - Suspicious PE
Webroot W32.Injector.Gen
Avira TR/Crypt.XPACK.rjqqp
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft Trojan:Win32/FormBook.BX!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.13
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
BitDefenderTheta AI:Packer.C1933C4121
MAX malware (ai score=81)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
APEX Malicious
ESET-NOD32 a variant of Win32/Injector.ELOL
Rising Trojan.Injector!1.C561 (CLASSIC)
Yandex Trojan.Igent.bTA8x9.73
Ikarus Trojan.Inject
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46e13c VirtualFree
• 0x46e140 VirtualAlloc
• 0x46e144 LocalFree
• 0x46e148 LocalAlloc
• 0x46e14c GetVersion
• 0x46e150 GetCurrentThreadId
• 0x46e15c VirtualQuery
• 0x46e160 WideCharToMultiByte
• 0x46e164 MultiByteToWideChar
• 0x46e168 lstrlenA
• 0x46e16c lstrcpynA
• 0x46e170 LoadLibraryExA
• 0x46e174 GetThreadLocale
• 0x46e178 GetStartupInfoA
• 0x46e17c GetProcAddress
• 0x46e180 GetModuleHandleA
• 0x46e184 GetModuleFileNameA
• 0x46e188 GetLocaleInfoA
• 0x46e18c GetCommandLineA
• 0x46e190 FreeLibrary
• 0x46e194 FindFirstFileA
• 0x46e198 FindClose
• 0x46e19c ExitProcess
• 0x46e1a0 WriteFile
• 0x46e1a8 RtlUnwind
• 0x46e1ac RaiseException
• 0x46e1b0 GetStdHandle
Library user32.dll:
• 0x46e1b8 GetKeyboardType
• 0x46e1bc LoadStringA
• 0x46e1c0 MessageBoxA
• 0x46e1c4 CharNextA
Library advapi32.dll:
• 0x46e1cc RegQueryValueExA
• 0x46e1d0 RegOpenKeyExA
• 0x46e1d4 RegCloseKey
Library oleaut32.dll:
• 0x46e1dc SysFreeString
• 0x46e1e0 SysReAllocStringLen
• 0x46e1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46e1ec TlsSetValue
• 0x46e1f0 TlsGetValue
• 0x46e1f4 LocalAlloc
• 0x46e1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46e200 RegQueryValueExA
• 0x46e204 RegOpenKeyExA
• 0x46e208 RegCloseKey
Library kernel32.dll:
• 0x46e210 lstrcpyA
• 0x46e214 WriteFile
• 0x46e21c WaitForSingleObject
• 0x46e220 VirtualQuery
• 0x46e224 VirtualAlloc
• 0x46e228 Sleep
• 0x46e22c SizeofResource
• 0x46e230 SetThreadLocale
• 0x46e234 SetFilePointer
• 0x46e238 SetEvent
• 0x46e23c SetErrorMode
• 0x46e240 SetEndOfFile
• 0x46e244 ResetEvent
• 0x46e248 ReadFile
• 0x46e24c MulDiv
• 0x46e250 LockResource
• 0x46e254 LoadResource
• 0x46e258 LoadLibraryA
• 0x46e264 GlobalUnlock
• 0x46e268 GlobalReAlloc
• 0x46e26c GlobalHandle
• 0x46e270 GlobalLock
• 0x46e274 GlobalFree
• 0x46e278 GlobalFindAtomA
• 0x46e27c GlobalDeleteAtom
• 0x46e280 GlobalAlloc
• 0x46e284 GlobalAddAtomA
• 0x46e288 GetVersionExA
• 0x46e28c GetVersion
• 0x46e290 GetTickCount
• 0x46e294 GetThreadLocale
• 0x46e298 GetTempPathA
• 0x46e2a0 GetSystemTime
• 0x46e2a4 GetSystemInfo
• 0x46e2a8 GetStringTypeExA
• 0x46e2ac GetStdHandle
• 0x46e2b0 GetProcAddress
• 0x46e2b4 GetModuleHandleA
• 0x46e2b8 GetModuleFileNameA
• 0x46e2bc GetLocaleInfoA
• 0x46e2c0 GetLocalTime
• 0x46e2c4 GetLastError
• 0x46e2c8 GetFullPathNameA
• 0x46e2cc GetFileSize
• 0x46e2d0 GetDiskFreeSpaceA
• 0x46e2d4 GetDateFormatA
• 0x46e2d8 GetCurrentThreadId
• 0x46e2dc GetCurrentProcessId
• 0x46e2e0 GetCPInfo
• 0x46e2e4 GetACP
• 0x46e2e8 FreeResource
• 0x46e2ec InterlockedExchange
• 0x46e2f0 FreeLibrary
• 0x46e2f4 FormatMessageA
• 0x46e2f8 FindResourceA
• 0x46e300 ExitThread
• 0x46e304 EnumCalendarInfoA
• 0x46e30c DeleteFileA
• 0x46e314 CreateThread
• 0x46e318 CreateFileA
• 0x46e31c CreateEventA
• 0x46e320 CompareStringA
• 0x46e324 CloseHandle
Library version.dll:
• 0x46e32c VerQueryValueA
• 0x46e334 GetFileVersionInfoA
Library gdi32.dll:
• 0x46e33c UnrealizeObject
• 0x46e340 StretchBlt
• 0x46e344 SetWindowOrgEx
• 0x46e348 SetViewportOrgEx
• 0x46e34c SetTextColor
• 0x46e350 SetStretchBltMode
• 0x46e354 SetROP2
• 0x46e358 SetPixel
• 0x46e35c SetDIBColorTable
• 0x46e360 SetBrushOrgEx
• 0x46e364 SetBkMode
• 0x46e368 SetBkColor
• 0x46e36c SelectPalette
• 0x46e370 SelectObject
• 0x46e374 SaveDC
• 0x46e378 RestoreDC
• 0x46e37c RectVisible
• 0x46e380 RealizePalette
• 0x46e384 PatBlt
• 0x46e388 MoveToEx
• 0x46e38c MaskBlt
• 0x46e390 LineTo
• 0x46e394 IntersectClipRect
• 0x46e398 GetWindowOrgEx
• 0x46e39c GetTextMetricsA
• 0x46e3a8 GetStockObject
• 0x46e3ac GetPixel
• 0x46e3b0 GetPaletteEntries
• 0x46e3b4 GetObjectA
• 0x46e3b8 GetDeviceCaps
• 0x46e3bc GetDIBits
• 0x46e3c0 GetDIBColorTable
• 0x46e3c4 GetDCOrgEx
• 0x46e3cc GetClipBox
• 0x46e3d0 GetBrushOrgEx
• 0x46e3d4 GetBitmapBits
• 0x46e3d8 ExcludeClipRect
• 0x46e3dc DeleteObject
• 0x46e3e0 DeleteDC
• 0x46e3e4 CreateSolidBrush
• 0x46e3e8 CreatePenIndirect
• 0x46e3ec CreatePalette
• 0x46e3f4 CreateFontIndirectA
• 0x46e3f8 CreateDIBitmap
• 0x46e3fc CreateDIBSection
• 0x46e400 CreateCompatibleDC
• 0x46e408 CreateBrushIndirect
• 0x46e40c CreateBitmap
• 0x46e410 BitBlt
Library user32.dll:
• 0x46e418 CreateWindowExA
• 0x46e41c WindowFromPoint
• 0x46e420 WinHelpA
• 0x46e424 WaitMessage
• 0x46e428 UpdateWindow
• 0x46e42c UnregisterClassA
• 0x46e430 UnhookWindowsHookEx
• 0x46e434 TranslateMessage
• 0x46e43c TrackPopupMenu
• 0x46e444 ShowWindow
• 0x46e448 ShowScrollBar
• 0x46e44c ShowOwnedPopups
• 0x46e450 ShowCursor
• 0x46e454 SetWindowsHookExA
• 0x46e458 SetWindowPos
• 0x46e45c SetWindowPlacement
• 0x46e460 SetWindowLongA
• 0x46e464 SetTimer
• 0x46e468 SetScrollRange
• 0x46e46c SetScrollPos
• 0x46e470 SetScrollInfo
• 0x46e474 SetRect
• 0x46e478 SetPropA
• 0x46e47c SetParent
• 0x46e480 SetMenuItemInfoA
• 0x46e484 SetMenu
• 0x46e488 SetForegroundWindow
• 0x46e48c SetFocus
• 0x46e490 SetCursor
• 0x46e494 SetClassLongA
• 0x46e498 SetCapture
• 0x46e49c SetActiveWindow
• 0x46e4a0 SendMessageA
• 0x46e4a4 ScrollWindow
• 0x46e4a8 ScreenToClient
• 0x46e4ac RemovePropA
• 0x46e4b0 RemoveMenu
• 0x46e4b4 ReleaseDC
• 0x46e4b8 ReleaseCapture
• 0x46e4c4 RegisterClassA
• 0x46e4c8 RedrawWindow
• 0x46e4cc PtInRect
• 0x46e4d0 PostQuitMessage
• 0x46e4d4 PostMessageA
• 0x46e4d8 PeekMessageA
• 0x46e4dc OffsetRect
• 0x46e4e0 OemToCharA
• 0x46e4e4 MessageBoxA
• 0x46e4e8 MapWindowPoints
• 0x46e4ec MapVirtualKeyA
• 0x46e4f0 LoadStringA
• 0x46e4f4 LoadKeyboardLayoutA
• 0x46e4f8 LoadIconA
• 0x46e4fc LoadCursorA
• 0x46e500 LoadBitmapA
• 0x46e504 KillTimer
• 0x46e508 IsZoomed
• 0x46e50c IsWindowVisible
• 0x46e510 IsWindowEnabled
• 0x46e514 IsWindow
• 0x46e518 IsRectEmpty
• 0x46e51c IsIconic
• 0x46e520 IsDialogMessageA
• 0x46e524 IsChild
• 0x46e528 InvalidateRect
• 0x46e52c IntersectRect
• 0x46e530 InsertMenuItemA
• 0x46e534 InsertMenuA
• 0x46e538 InflateRect
• 0x46e540 GetWindowTextA
• 0x46e544 GetWindowRect
• 0x46e548 GetWindowPlacement
• 0x46e54c GetWindowLongA
• 0x46e550 GetWindowDC
• 0x46e554 GetTopWindow
• 0x46e558 GetSystemMetrics
• 0x46e55c GetSystemMenu
• 0x46e560 GetSysColorBrush
• 0x46e564 GetSysColor
• 0x46e568 GetSubMenu
• 0x46e56c GetScrollRange
• 0x46e570 GetScrollPos
• 0x46e574 GetScrollInfo
• 0x46e578 GetPropA
• 0x46e57c GetParent
• 0x46e580 GetWindow
• 0x46e584 GetMenuStringA
• 0x46e588 GetMenuState
• 0x46e58c GetMenuItemInfoA
• 0x46e590 GetMenuItemID
• 0x46e594 GetMenuItemCount
• 0x46e598 GetMenu
• 0x46e59c GetLastActivePopup
• 0x46e5a0 GetKeyboardState
• 0x46e5a8 GetKeyboardLayout
• 0x46e5ac GetKeyState
• 0x46e5b0 GetKeyNameTextA
• 0x46e5b4 GetIconInfo
• 0x46e5b8 GetForegroundWindow
• 0x46e5bc GetFocus
• 0x46e5c0 GetDlgItem
• 0x46e5c4 GetDesktopWindow
• 0x46e5c8 GetDCEx
• 0x46e5cc GetDC
• 0x46e5d0 GetCursorPos
• 0x46e5d4 GetCursor
• 0x46e5d8 GetClientRect
• 0x46e5dc GetClassNameA
• 0x46e5e0 GetClassInfoA
• 0x46e5e4 GetCapture
• 0x46e5e8 GetActiveWindow
• 0x46e5ec FrameRect
• 0x46e5f0 FindWindowA
• 0x46e5f4 FillRect
• 0x46e5f8 EqualRect
• 0x46e5fc EnumWindows
• 0x46e600 EnumThreadWindows
• 0x46e604 EndPaint
• 0x46e608 EnableWindow
• 0x46e60c EnableScrollBar
• 0x46e610 EnableMenuItem
• 0x46e614 DrawTextA
• 0x46e618 DrawMenuBar
• 0x46e61c DrawIconEx
• 0x46e620 DrawIcon
• 0x46e624 DrawFrameControl
• 0x46e628 DrawFocusRect
• 0x46e62c DrawEdge
• 0x46e630 DispatchMessageA
• 0x46e634 DestroyWindow
• 0x46e638 DestroyMenu
• 0x46e63c DestroyIcon
• 0x46e640 DestroyCursor
• 0x46e644 DeleteMenu
• 0x46e648 DefWindowProcA
• 0x46e64c DefMDIChildProcA
• 0x46e650 DefFrameProcA
• 0x46e654 CreatePopupMenu
• 0x46e658 CreateMenu
• 0x46e65c CreateIcon
• 0x46e660 ClientToScreen
• 0x46e664 CheckMenuItem
• 0x46e668 CallWindowProcA
• 0x46e66c CallNextHookEx
• 0x46e670 BeginPaint
• 0x46e674 CharNextA
• 0x46e678 CharLowerA
• 0x46e67c CharUpperBuffA
• 0x46e680 CharToOemA
• 0x46e684 AdjustWindowRectEx
Library kernel32.dll:
• 0x46e690 Sleep
Library oleaut32.dll:
• 0x46e698 SafeArrayPtrOfIndex
• 0x46e69c SafeArrayGetUBound
• 0x46e6a0 SafeArrayGetLBound
• 0x46e6a4 SafeArrayCreate
• 0x46e6a8 VariantChangeType
• 0x46e6ac VariantCopy
• 0x46e6b0 VariantClear
• 0x46e6b4 VariantInit
Library comctl32.dll:
• 0x46e6c4 ImageList_Write
• 0x46e6c8 ImageList_Read
• 0x46e6d8 ImageList_DragMove
• 0x46e6dc ImageList_DragLeave
• 0x46e6e0 ImageList_DragEnter
• 0x46e6e4 ImageList_EndDrag
• 0x46e6e8 ImageList_BeginDrag
• 0x46e6ec ImageList_Remove
• 0x46e6f0 ImageList_DrawEx
• 0x46e6f4 ImageList_Replace
• 0x46e6f8 ImageList_Draw
• 0x46e708 ImageList_Add
• 0x46e710 ImageList_Destroy
• 0x46e714 ImageList_Create
Library comdlg32.dll:
• 0x46e71c GetSaveFileNameA
• 0x46e720 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.