SmartHawk

10.0

0-day

44 个模型检测该样本为恶意！

重新分析

下载样本

e157307a0ae395f69fc74b41439b15540f0782dc03b0298146f928e88344dc86

2374afb9995036716d57a36341f6d6c6.exe

分析耗时

95s

最近分析

文件大小

740.5KB

静态报毒动态报毒 AGENTTESLA AI SCORE=80 APPLICUNWNT@0 ATTRIBUTE CLOUD CONFIDENCE ELDORADO FAREIT GDSDA GENERICKD GENKRYPTIK HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALICIOUS PE MALWAREX PHBAG R049C0DGV20 RISKTOOL SCORE SUSGEN UM0@ACJDSHM UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXU!2374AFB99950	20200814	6.0.6.653
Alibaba	Trojan:Win32/Kryptik.e77cdd09	20190527	0.3.0.5
Avast		20200814	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200814	2013.8.14.323
Tencent		20200814	1.0.0.1
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

Queries for the computername (4 个事件)

Time & API	Arguments	Status	Return
1619297988.342501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619297989.952501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619297991.936501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619297992.655501 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (50 out of 107 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297935.436751 IsDebuggerPresent		failed	0	0
1619297935.436751 IsDebuggerPresent		failed	0	0
1619297936.936751 IsDebuggerPresent		failed	0	0
1619297937.436751 IsDebuggerPresent		failed	0	0
1619297937.936751 IsDebuggerPresent		failed	0	0
1619297938.436751 IsDebuggerPresent		failed	0	0
1619297938.936751 IsDebuggerPresent		failed	0	0
1619297939.436751 IsDebuggerPresent		failed	0	0
1619297939.936751 IsDebuggerPresent		failed	0	0
1619297940.436751 IsDebuggerPresent		failed	0	0
1619297940.936751 IsDebuggerPresent		failed	0	0
1619297941.436751 IsDebuggerPresent		failed	0	0
1619297941.936751 IsDebuggerPresent		failed	0	0
1619297942.436751 IsDebuggerPresent		failed	0	0
1619297942.936751 IsDebuggerPresent		failed	0	0
1619297943.436751 IsDebuggerPresent		failed	0	0
1619297943.936751 IsDebuggerPresent		failed	0	0
1619297944.436751 IsDebuggerPresent		failed	0	0
1619297944.936751 IsDebuggerPresent		failed	0	0
1619297945.436751 IsDebuggerPresent		failed	0	0
1619297945.936751 IsDebuggerPresent		failed	0	0
1619297946.436751 IsDebuggerPresent		failed	0	0
1619297946.936751 IsDebuggerPresent		failed	0	0
1619297947.436751 IsDebuggerPresent		failed	0	0
1619297947.936751 IsDebuggerPresent		failed	0	0
1619297948.436751 IsDebuggerPresent		failed	0	0
1619297948.936751 IsDebuggerPresent		failed	0	0
1619297949.436751 IsDebuggerPresent		failed	0	0
1619297949.936751 IsDebuggerPresent		failed	0	0
1619297950.436751 IsDebuggerPresent		failed	0	0
1619297950.936751 IsDebuggerPresent		failed	0	0
1619297951.436751 IsDebuggerPresent		failed	0	0
1619297951.936751 IsDebuggerPresent		failed	0	0
1619297952.436751 IsDebuggerPresent		failed	0	0
1619297952.936751 IsDebuggerPresent		failed	0	0
1619297953.436751 IsDebuggerPresent		failed	0	0
1619297953.936751 IsDebuggerPresent		failed	0	0
1619297954.436751 IsDebuggerPresent		failed	0	0
1619297954.936751 IsDebuggerPresent		failed	0	0
1619297955.436751 IsDebuggerPresent		failed	0	0
1619297955.936751 IsDebuggerPresent		failed	0	0
1619297956.436751 IsDebuggerPresent		failed	0	0
1619297956.936751 IsDebuggerPresent		failed	0	0
1619297957.436751 IsDebuggerPresent		failed	0	0
1619297957.936751 IsDebuggerPresent		failed	0	0
1619297958.436751 IsDebuggerPresent		failed	0	0
1619297958.936751 IsDebuggerPresent		failed	0	0
1619297959.436751 IsDebuggerPresent		failed	0	0
1619297959.936751 IsDebuggerPresent		failed	0	0
1619297960.436751 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297935.483751 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297991.842501 __exception__	stacktrace: 0x1fb00a5 0x486f28a DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73e721db CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e94a2a CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e94bcc CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e94c01 CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e94c21 GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73f5ce82 GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73f5cf90 GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73f5cda4 GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73f5d199 GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73f5d09a _CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73fdaf00 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752955ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75517f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75514de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1830048 registers.edi: 37050732 registers.eax: 0 registers.ebp: 1830092 registers.edx: 8 registers.ebx: 0 registers.esi: 1865688603 registers.ecx: 0 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 dc 69 c6 62 3d 0b 9b exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1fb380a	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619297991.842501
__exception__

stacktrace:

0x1fb00a5
0x486f28a
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73e721db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e94a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e94bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e94c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e94c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73f5ce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73f5cf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73f5cda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73f5d199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73f5d09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73fdaf00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752955ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75517f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75514de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1830048
registers.edi: 37050732
registers.eax: 0
registers.ebp: 1830092
registers.edx: 8
registers.ebx: 0
registers.esi: 1865688603
registers.ecx: 0
exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 dc 69 c6 62 3d 0b 9b
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x1fb380a

success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 174 个事件)

Time & API	Arguments	Status	Return
1619297934.999751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x009d0000	success	0
1619297934.999751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b70000	success	0
1619297935.217751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00bb0000	success	0
1619297935.217751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb0000	success	0
1619297935.311751 NtProtectVirtualMemory	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1619297935.436751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00cf0000	success	0
1619297935.436751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e70000	success	0
1619297935.436751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success	0
1619297935.452751 NtProtectVirtualMemory	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1619297935.452751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success	0
1619297935.670751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success	0
1619297935.811751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success	0
1619297935.811751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success	0
1619297935.811751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619297935.936751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a3000	success	0
1619297935.952751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a4000	success	0
1619297935.983751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success	0
1619297936.077751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00810000	success	0
1619297936.124751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a5000	success	0
1619297936.124751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00811000	success	0
1619297936.139751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00812000	success	0
1619297936.139751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00813000	success	0
1619297936.202751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00814000	success	0
1619297936.405751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a6000	success	0
1619297936.483751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00815000	success	0
1619297936.624751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00816000	success	0
1619297936.905751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00817000	success	0
1619297936.967751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a7000	success	0
1619297936.999751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a8000	success	0
1619297936.999751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00818000	success	0
1619297937.327751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a9000	success	0
1619297937.342751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619297937.405751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00819000	success	0
1619297937.405751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619297937.405751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619297937.405751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b0000	success	0
1619297937.467751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0081a000	success	0
1619297937.499751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b1000	success	0
1619297937.577751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0081d000	success	0
1619297976.061751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039c000	success	0
1619297976.155751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b2000	success	0
1619297976.155751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ad000	success	0
1619297976.155751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0081e000	success	0
1619297976.233751 NtProtectVirtualMemory	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 304128 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05080400	failed	3221225550
1619297982.717751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0081f000	success	0
1619297982.749751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b3000	success	0
1619297982.749751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01040000	success	0
1619297982.795751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01041000	success	0
1619297982.795751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01042000	success	0
1619297982.983751 NtAllocateVirtualMemory	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01043000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.534034939268922

section

{'size_of_data': '0x000b8800', 'virtual_address': '0x00002000', 'entropy': 7.534034939268922, 'name': '.text', 'virtual_size': '0x000b8724'}

description

A section with a high entropy has been found

entropy

0.9972972972972973

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297936.592751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619297987.889501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297984.233751 NtAllocateVirtualMemory	process_identifier: 2952 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005e50 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

A process attempted to delay the analysis task. (2 个事件)

description	RegSvcs.exe tried to sleep 2728185 seconds, actually delayed analysis time by 2728185 seconds
description	2374afb9995036716d57a36341f6d6c6.exe tried to sleep 138 seconds, actually delayed analysis time by 138 seconds

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\LKUgjc

reg_value

C:\Users\Administrator.Oskar-PC\AppData\Roaming\LKUgjc\LKUgjc.exe

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619297984.233751 WriteProcessMemory	process_identifier: 2952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬^à¬Ê à@ @DÊWà H.text¤ª ¬ `.rsrcà®@@.reloc²@B process_handle: 0x00005e50 base_address: 0x00400000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: 0HXà´´4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoð000004b0,FileDescription 0FileVersion0.0.0.0p(InternalNamectwRxHxNeUazICTYFVvbaIAtabQqEtTUQNd.exe(LegalCopyright x(OriginalFilenamectwRxHxNeUazICTYFVvbaIAtabQqEtTUQNd.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00005e50 base_address: 0x0044e000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: À : process_handle: 0x00005e50 base_address: 0x00450000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: @ process_handle: 0x00005e50 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619297984.233751 WriteProcessMemory	process_identifier: 2952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬^à¬Ê à@ @DÊWà H.text¤ª ¬ `.rsrcà®@@.reloc²@B process_handle: 0x00005e50 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2428 called NtSetContextThread to modify thread in remote process 2952
1619297984.264751 NtSetContextThread	thread_handle: 0x00010d2c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4508318 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2952	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\LKUgjc\LKUgjc.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2428 resumed a thread in remote process 2952
1619297985.983751 NtResumeThread	thread_handle: 0x00010d2c suspend_count: 1 process_identifier: 2952	success	0	0

Executed a process and injected code into it, probably while unpacking (24 个事件)

Time & API	Arguments	Status	Return
1619297935.436751 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2428	success	0
1619297935.467751 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2428	success	0
1619297935.499751 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2428	success	0
1619297936.889751 NtResumeThread	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2428	success	0
1619297936.920751 NtResumeThread	thread_handle: 0x0000020c suspend_count: 1 process_identifier: 2428	success	0
1619297983.624751 NtResumeThread	thread_handle: 0x0000f448 suspend_count: 1 process_identifier: 2428	success	0
1619297983.639751 NtResumeThread	thread_handle: 0x00003eec suspend_count: 1 process_identifier: 2428	success	0
1619297984.233751 CreateProcessInternalW	thread_identifier: 200 thread_handle: 0x00010d2c process_identifier: 2952 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00005e50 inherit_handles: 0	success	1
1619297984.233751 NtGetContextThread	thread_handle: 0x00010d2c	success	0
1619297984.233751 NtAllocateVirtualMemory	process_identifier: 2952 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005e50 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619297984.233751 WriteProcessMemory	process_identifier: 2952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¬^à¬Ê à@ @DÊWà H.text¤ª ¬ `.rsrcà®@@.reloc²@B process_handle: 0x00005e50 base_address: 0x00400000	success	1
1619297984.233751 WriteProcessMemory	process_identifier: 2952 buffer: process_handle: 0x00005e50 base_address: 0x00402000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: 0HXà´´4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoð000004b0,FileDescription 0FileVersion0.0.0.0p(InternalNamectwRxHxNeUazICTYFVvbaIAtabQqEtTUQNd.exe(LegalCopyright x(OriginalFilenamectwRxHxNeUazICTYFVvbaIAtabQqEtTUQNd.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00005e50 base_address: 0x0044e000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: À : process_handle: 0x00005e50 base_address: 0x00450000	success	1
1619297984.249751 WriteProcessMemory	process_identifier: 2952 buffer: @ process_handle: 0x00005e50 base_address: 0x7efde008	success	1
1619297984.264751 NtSetContextThread	thread_handle: 0x00010d2c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4508318 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2952	success	0
1619297985.983751 NtResumeThread	thread_handle: 0x00010d2c suspend_count: 1 process_identifier: 2952	success	0
1619297986.374501 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2952	success	0
1619297986.374501 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2952	success	0
1619297986.467501 NtResumeThread	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2952	success	0
1619297989.655501 NtResumeThread	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2952	success	0
1619297989.780501 NtResumeThread	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2952	success	0
1619297991.920501 NtResumeThread	thread_handle: 0x00000368 suspend_count: 1 process_identifier: 2952	success	0
1619297998.749501 NtResumeThread	thread_handle: 0x000003bc suspend_count: 1 process_identifier: 2952	success	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34259953
McAfee	Fareit-FXU!2374AFB99950
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0056b9891 )
BitDefender	Trojan.GenericKD.34259953
K7GW	Trojan ( 0056b9891 )
Cybereason	malicious.71c2aa
BitDefenderTheta	Gen:NN.ZemsilF.34152.Um0@aCjdSHm
F-Prot	W32/MSIL_Troj.YA.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Alibaba	Trojan:Win32/Kryptik.e77cdd09
ViRobot	Trojan.Win32.S.Agent.758272.AK
AegisLab	Riskware.Win32.Generic.1!c
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ad-Aware	Trojan.GenericKD.34259953
Comodo	ApplicUnwnt@0
F-Secure	Trojan.TR/Kryptik.phbag
Fortinet	Riskware/Generic
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Cyren	W32/MSIL_Troj.YA.gen!Eldorado
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Kryptik.phbag
MAX	malware (ai score=80)
Antiy-AVL	Trojan/MSIL.Crypt
Arcabit	Trojan.Generic.D20AC3F1
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
Microsoft	TrojanSpy:MSIL/AgentTesla.AQ!MTB
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.RL_Generic.C4172766
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
ESET-NOD32	a variant of MSIL/Kryptik.XDK
TrendMicro-HouseCall	TROJ_GEN.R049C0DGV20
SentinelOne	DFI - Malicious PE
GData	Trojan.GenericKD.34259953
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Win32/Virus.RiskTool.c0f

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-30 11:53:28

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 216.58.199.14 CNAME clients.l.google.com A 172.217.24.46	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	49235	8.8.8.8	53
192.168.56.101	51378	8.8.8.8	53
192.168.56.101	53657	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.