SmartHawk

9.8

极危

55 个模型检测该样本为恶意！

重新分析

下载样本

d4ca1a42f5c889f5b6e12a5f4059ff6bc22c6ea99f830d561baf9d6de3b42eea

28cfa40c77b39ff4dd7b57680d91afff.exe

分析耗时

91s

最近分析

文件大小

434.0KB

静态报毒动态报毒 AI SCORE=89 ATTRIBUTE BM0@AKRR7FH CONFIDENCE ELDORADO FAREIT FORMBOOK GENERICKD GENOME GOBXX@0 HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HSVUCK HTMT KRYPTIK MALICIOUS PE PWSX R049C0DH620 SCORE SPYBOTNET SUSGEN UNSAFE ZEMSILF ZLXGT 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXO!28CFA40C77B3	20200913	6.0.6.653
Alibaba	Trojan:MSIL/Formbook.403b27ce	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Tencent	Msil.Trojan.Agent.Htmt	20200914	1.0.0.1
Kingsoft		20200914	2013.8.14.323

Checks if process is being debugged by a debugger (50 out of 105 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345214.1865 IsDebuggerPresent		failed	0	0
1619345215.4365 IsDebuggerPresent		failed	0	0
1619345215.9525 IsDebuggerPresent		failed	0	0
1619345216.4525 IsDebuggerPresent		failed	0	0
1619345216.9525 IsDebuggerPresent		failed	0	0
1619345217.4525 IsDebuggerPresent		failed	0	0
1619345217.9525 IsDebuggerPresent		failed	0	0
1619345218.4525 IsDebuggerPresent		failed	0	0
1619345218.9525 IsDebuggerPresent		failed	0	0
1619345219.4525 IsDebuggerPresent		failed	0	0
1619345219.9525 IsDebuggerPresent		failed	0	0
1619345220.4525 IsDebuggerPresent		failed	0	0
1619345220.9525 IsDebuggerPresent		failed	0	0
1619345221.4525 IsDebuggerPresent		failed	0	0
1619345221.9525 IsDebuggerPresent		failed	0	0
1619345222.4525 IsDebuggerPresent		failed	0	0
1619345222.9525 IsDebuggerPresent		failed	0	0
1619345223.4525 IsDebuggerPresent		failed	0	0
1619345223.9525 IsDebuggerPresent		failed	0	0
1619345224.4525 IsDebuggerPresent		failed	0	0
1619345224.9525 IsDebuggerPresent		failed	0	0
1619345225.4525 IsDebuggerPresent		failed	0	0
1619345225.9525 IsDebuggerPresent		failed	0	0
1619345226.4525 IsDebuggerPresent		failed	0	0
1619345226.9525 IsDebuggerPresent		failed	0	0
1619345227.4525 IsDebuggerPresent		failed	0	0
1619345227.9525 IsDebuggerPresent		failed	0	0
1619345228.4525 IsDebuggerPresent		failed	0	0
1619345228.9525 IsDebuggerPresent		failed	0	0
1619345229.4525 IsDebuggerPresent		failed	0	0
1619345229.9525 IsDebuggerPresent		failed	0	0
1619345230.4525 IsDebuggerPresent		failed	0	0
1619345230.9525 IsDebuggerPresent		failed	0	0
1619345231.4525 IsDebuggerPresent		failed	0	0
1619345231.9525 IsDebuggerPresent		failed	0	0
1619345232.4525 IsDebuggerPresent		failed	0	0
1619345232.9525 IsDebuggerPresent		failed	0	0
1619345233.4525 IsDebuggerPresent		failed	0	0
1619345233.9525 IsDebuggerPresent		failed	0	0
1619345234.4525 IsDebuggerPresent		failed	0	0
1619345234.9525 IsDebuggerPresent		failed	0	0
1619345235.4525 IsDebuggerPresent		failed	0	0
1619345235.9525 IsDebuggerPresent		failed	0	0
1619345236.4525 IsDebuggerPresent		failed	0	0
1619345236.9525 IsDebuggerPresent		failed	0	0
1619345237.4525 IsDebuggerPresent		failed	0	0
1619345237.9525 IsDebuggerPresent		failed	0	0
1619345238.4525 IsDebuggerPresent		failed	0	0
1619345238.9525 IsDebuggerPresent		failed	0	0
1619345239.4525 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345264.2025 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 103 个事件)

Time & API	Arguments	Status	Return
1619345213.4215 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00240000	success	0
1619345213.4215 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00290000	success	0
1619345214.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success	0
1619345214.1865 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success	0
1619345214.1865 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success	0
1619345214.1865 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success	0
1619345214.4675 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success	0
1619345214.5775 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success	0
1619345214.6085 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success	0
1619345214.6085 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success	0
1619345214.6555 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success	0
1619345214.7335 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00550000	success	0
1619345214.9835 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success	0
1619345215.0775 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success	0
1619345215.1555 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success	0
1619345215.1865 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success	0
1619345215.2175 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00435000	success	0
1619345215.6245 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00551000	success	0
1619345218.1555 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success	0
1619345218.1555 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success	0
1619345221.4675 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success	0
1619345262.5145 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success	0
1619345262.6245 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fb000	success	0
1619345262.9675 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042c000	success	0
1619345262.9675 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00553000	success	0
1619345263.0615 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00416000	success	0
1619345263.0925 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success	0
1619345263.1085 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00554000	success	0
1619345263.2495 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 279552 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af0400	failed	3221225550
1619345265.9995 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00556000	success	0
1619345266.0145 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success	0
1619345266.0305 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00557000	success	0
1619345266.0305 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00558000	success	0
1619345266.0615 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00559000	success	0
1619345266.1395 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success	0
1619345266.1555 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055b000	success	0
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af0178	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af01a0	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af01c8	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af01f0	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04af0218	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351be	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351b2	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b34800	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351cc	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351f0	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351f8	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b351fc	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b35204	failed	3221225550
1619345266.1555 NtProtectVirtualMemory	process_identifier: 1404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b35208	failed	3221225550

A process attempted to delay the analysis task. (1 个事件)

description

28cfa40c77b39ff4dd7b57680d91afff.exe tried to sleep 151 seconds, actually delayed analysis time by 151 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.898862432723766

section

{'size_of_data': '0x0006be00', 'virtual_address': '0x00002000', 'entropy': 7.898862432723766, 'name': '.text', 'virtual_size': '0x0006bde4'}

description

A section with a high entropy has been found

entropy

0.9953863898500577

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345215.0145 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345266.3275 NtAllocateVirtualMemory	process_identifier: 2656 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010910 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619345266.3275 WriteProcessMemory	process_identifier: 2656 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÎ¤*_àRNq @ À@øpSð H.textTQ R `.rsrcðT@@.reloc X@B process_handle: 0x00010910 base_address: 0x00400000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameWEBpNAFPTquMqqFFYkthXpCUUq.exe(LegalCopyright hOriginalFilenameWEBpNAFPTquMqqFFYkthXpCUUq.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00010910 base_address: 0x00448000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: pP1 process_handle: 0x00010910 base_address: 0x0044a000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: @ process_handle: 0x00010910 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345266.3275 WriteProcessMemory	process_identifier: 2656 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÎ¤*_àRNq @ À@øpSð H.textTQ R `.rsrcðT@@.reloc X@B process_handle: 0x00010910 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1404 called NtSetContextThread to modify thread in remote process 2656
1619345266.3425 NtSetContextThread	thread_handle: 0x00011404 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4485454 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2656	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1404 resumed a thread in remote process 2656
1619345266.4215 NtResumeThread	thread_handle: 0x00011404 suspend_count: 1 process_identifier: 2656	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619345214.1865 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1404	success	0
1619345214.2335 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1404	success	0
1619345215.4055 NtResumeThread	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 1404	success	0
1619345215.4365 NtResumeThread	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 1404	success	0
1619345266.1715 NtResumeThread	thread_handle: 0x00008e34 suspend_count: 1 process_identifier: 1404	success	0
1619345266.1715 NtResumeThread	thread_handle: 0x000104a8 suspend_count: 1 process_identifier: 1404	success	0
1619345266.2965 CreateProcessInternalW	thread_identifier: 916 thread_handle: 0x00011404 process_identifier: 2656 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\28cfa40c77b39ff4dd7b57680d91afff.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\28cfa40c77b39ff4dd7b57680d91afff.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00010910 inherit_handles: 0	success	1
1619345266.3275 NtGetContextThread	thread_handle: 0x00011404	success	0
1619345266.3275 NtAllocateVirtualMemory	process_identifier: 2656 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010910 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619345266.3275 WriteProcessMemory	process_identifier: 2656 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÎ¤*_àRNq @ À@øpSð H.textTQ R `.rsrcðT@@.reloc X@B process_handle: 0x00010910 base_address: 0x00400000	success	1
1619345266.3275 WriteProcessMemory	process_identifier: 2656 buffer: process_handle: 0x00010910 base_address: 0x00402000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameWEBpNAFPTquMqqFFYkthXpCUUq.exe(LegalCopyright hOriginalFilenameWEBpNAFPTquMqqFFYkthXpCUUq.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00010910 base_address: 0x00448000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: pP1 process_handle: 0x00010910 base_address: 0x0044a000	success	1
1619345266.3425 WriteProcessMemory	process_identifier: 2656 buffer: @ process_handle: 0x00010910 base_address: 0x7efde008	success	1
1619345266.3425 NtSetContextThread	thread_handle: 0x00011404 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4485454 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2656	success	0
1619345266.4215 NtResumeThread	thread_handle: 0x00011404 suspend_count: 1 process_identifier: 2656	success	0
1619345266.5925 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2656	success	0
1619345266.5925 NtResumeThread	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 2656	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34297038
FireEye	Generic.mg.28cfa40c77b39ff4
CAT-QuickHeal	Trojan.MSIL
McAfee	Fareit-FXO!28CFA40C77B3
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056bf781 )
Alibaba	Trojan:MSIL/Formbook.403b27ce
K7GW	Trojan ( 0056bf781 )
CrowdStrike	win/malicious_confidence_80% (W)
Arcabit	Trojan.Generic.D20B54CE
Invincea	Mal/Generic-S
Cyren	W32/MSIL_Troj.SX.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 90)
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKD.34297038
NANO-Antivirus	Trojan.Win32.Kryptik.hsvuck
ViRobot	Trojan.Win32.Z.Kryptik.444416.FI
Tencent	Msil.Trojan.Agent.Htmt
Ad-Aware	Trojan.GenericKD.34297038
Comodo	TrojWare.Win32.Genome.gobxx@0
F-Secure	Trojan.TR/Kryptik.zlxgt
DrWeb	BackDoor.SpyBotNET.25
Zillya	Trojan.Kryptik.Win32.2390549
TrendMicro	TROJ_GEN.R049C0DH620
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Kryptik.zlxgt
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:MSIL/Formbook.VN!MTB
AegisLab	Trojan.Win32.Malicious.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
GData	Trojan.GenericKD.34297038
AhnLab-V3	Malware/Win32.RL_Generic.C4177037
BitDefenderTheta	Gen:NN.ZemsilF.34242.Bm0@aKrr7fh
ALYac	Trojan.GenericKD.34297038
MAX	malware (ai score=89)
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XFP
TrendMicro-HouseCall	TROJ_GEN.R049C0DH620
Ikarus	Trojan.MSIL.Crypt
eGambit	Unsafe.AI_Score_80%
Fortinet	MSIL/Kryptik.XFP!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-05 20:34:00

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.160.78	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.