SmartHawk

8.8

极危

50 个模型检测该样本为恶意！

重新分析

下载样本

496b64b591fd2d02597c9f5a4e8570f6a169ae268de8ce463ee00c890a4ad112

2904c3bfa736172932918ccbf91f2d98.exe

分析耗时

111s

最近分析

文件大小

574.5KB

静态报毒动态报毒 AGENTTESLA AI SCORE=88 ATTRIBUTE AVSARHER BTJEKX CLOUD CONFIDENCE ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE IGENERIC JM0@AQIKE KRYPTIK LOKIBOT MALWAREX MSILKRYPT PCRYPT R002C0WGT20 R346455 SCORE SIGGEN2 SUSPICIOUS PE TSCOPE UNSAFE WACATAC ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXO!2904C3BFA736	20200806	6.0.6.653
Alibaba	Trojan:MSIL/Kryptik.e54cd1c2	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200806	18.4.3895.0
Kingsoft		20200806	2013.8.14.323
Tencent		20200806	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355399.743375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619355405.305375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (5 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355327.008375 IsDebuggerPresent		failed	0	0
1619355327.008375 IsDebuggerPresent		failed	0	0
1619355371.087375 IsDebuggerPresent		failed	0	0
1619355371.399375 IsDebuggerPresent		failed	0	0
1619355371.399375 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355327.040375 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 174 个事件)

Time & API	Arguments	Status	Return
1619355326.118375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00750000	success	0
1619355326.118375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00880000	success	0
1619355326.649375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00280000	success	0
1619355326.649375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00280000	success	0
1619355326.712375 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619355327.008375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success	0
1619355327.008375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e0000	success	0
1619355327.024375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030a000	success	0
1619355327.024375 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619355327.024375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00302000	success	0
1619355327.243375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00312000	success	0
1619355327.321375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00335000	success	0
1619355327.337375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0033b000	success	0
1619355327.337375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00337000	success	0
1619355327.493375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00313000	success	0
1619355327.524375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0031c000	success	0
1619355328.196375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00314000	success	0
1619355328.196375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00316000	success	0
1619355328.352375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00317000	success	0
1619355328.368375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success	0
1619355328.555375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0032a000	success	0
1619355328.555375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00327000	success	0
1619355328.665375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00326000	success	0
1619355328.758375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e1000	success	0
1619355328.758375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e2000	success	0
1619355328.837375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b1000	success	0
1619355328.837375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e3000	success	0
1619355328.837375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e4000	success	0
1619355328.868375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00318000	success	0
1619355328.899375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e5000	success	0
1619355328.899375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e9000	success	0
1619355328.915375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b2000	success	0
1619355328.930375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b3000	success	0
1619355329.571375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0031a000	success	0
1619355329.758375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00319000	success	0
1619355330.024375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00810000	success	0
1619355330.055375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00811000	success	0
1619355330.071375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b5000	success	0
1619355330.102375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00812000	success	0
1619355330.118375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b6000	success	0
1619355368.227375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00281000	success	0
1619355368.368375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b9000	success	0
1619355368.508375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030c000	success	0
1619355368.633375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00813000	success	0
1619355368.633375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0031d000	success	0
1619355368.649375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ba000	success	0
1619355368.883375 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 327168 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x060a0400	failed	3221225550
1619355370.774375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bb000	success	0
1619355370.774375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00814000	success	0
1619355370.774375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bc000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.739458909791027

section

{'size_of_data': '0x0008ac00', 'virtual_address': '0x00002000', 'entropy': 7.739458909791027, 'name': '.text', 'virtual_size': '0x0008abe8'}

description

A section with a high entropy has been found

entropy

0.9668989547038328

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355368.821375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619355383.055375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355393.883375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2440 process_handle: 0x00000234	failed	0	0
1619355393.883375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2440 process_handle: 0x00000234	success	0	0

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355371.180375 NtAllocateVirtualMemory	process_identifier: 1244 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00009af0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELú¥à^àV~u @ À@0uK0 H.textU V `.rsrc0X@@.reloc ^@B process_handle: 0x00009af0 base_address: 0x00400000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: P8h ¤Dê¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNamejgzMQnmDlapLWevcclZvQhSXlqYpJV.exe(LegalCopyright p#OriginalFilenamejgzMQnmDlapLWevcclZvQhSXlqYpJV.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x00009af0 base_address: 0x00448000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: p5 process_handle: 0x00009af0 base_address: 0x0044a000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: @ process_handle: 0x00009af0 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELú¥à^àV~u @ À@0uK0 H.textU V `.rsrc0X@@.reloc ^@B process_handle: 0x00009af0 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2440 called NtSetContextThread to modify thread in remote process 1244
1619355371.180375 NtSetContextThread	thread_handle: 0x0000be58 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4486526 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1244	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2440 resumed a thread in remote process 1244
1619355371.258375 NtResumeThread	thread_handle: 0x0000be58 suspend_count: 1 process_identifier: 1244	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (20 个事件)

Time & API	Arguments	Status	Return
1619355327.008375 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2440	success	0
1619355327.024375 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2440	success	0
1619355327.040375 NtResumeThread	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2440	success	0
1619355371.071375 NtResumeThread	thread_handle: 0x0000c35c suspend_count: 1 process_identifier: 2440	success	0
1619355371.071375 NtResumeThread	thread_handle: 0x00006508 suspend_count: 1 process_identifier: 2440	success	0
1619355371.180375 CreateProcessInternalW	thread_identifier: 2168 thread_handle: 0x0000be58 process_identifier: 1244 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2904c3bfa736172932918ccbf91f2d98.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2904c3bfa736172932918ccbf91f2d98.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00009af0 inherit_handles: 0	success	1
1619355371.180375 NtGetContextThread	thread_handle: 0x0000be58	success	0
1619355371.180375 NtAllocateVirtualMemory	process_identifier: 1244 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00009af0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELú¥à^àV~u @ À@0uK0 H.textU V `.rsrc0X@@.reloc ^@B process_handle: 0x00009af0 base_address: 0x00400000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: process_handle: 0x00009af0 base_address: 0x00402000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: P8h ¤Dê¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNamejgzMQnmDlapLWevcclZvQhSXlqYpJV.exe(LegalCopyright p#OriginalFilenamejgzMQnmDlapLWevcclZvQhSXlqYpJV.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x00009af0 base_address: 0x00448000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: p5 process_handle: 0x00009af0 base_address: 0x0044a000	success	1
1619355371.180375 WriteProcessMemory	process_identifier: 1244 buffer: @ process_handle: 0x00009af0 base_address: 0x7efde008	success	1
1619355371.180375 NtSetContextThread	thread_handle: 0x0000be58 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4486526 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1244	success	0
1619355371.258375 NtResumeThread	thread_handle: 0x0000be58 suspend_count: 1 process_identifier: 1244	success	0
1619355371.399375 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1244	success	0
1619355371.399375 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 1244	success	0
1619355371.399375 NtResumeThread	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 1244	success	0
1619355405.149375 NtResumeThread	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 1244	success	0
1619355405.180375 NtResumeThread	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 1244	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

MicroWorld-eScan	Trojan.GenericKD.43559366
FireEye	Generic.mg.2904c3bfa7361729
CAT-QuickHeal	Trojan.IGENERIC
McAfee	Fareit-FXO!2904C3BFA736
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2318739
K7AntiVirus	Trojan ( 0056b60e1 )
Alibaba	Trojan:MSIL/Kryptik.e54cd1c2
K7GW	Trojan ( 0056b60e1 )
Cybereason	malicious.56bebc
TrendMicro	TROJ_GEN.R002C0WGT20
F-Prot	W32/MSIL_Kryptik.BFZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.LokiBot-9164578-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.43559366
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Kryptik!8.8 (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Siggen2.52862
VIPRE	Trojan.Win32.Generic!BT
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.GenericKD.43559366 (B)
Paloalto	generic.ml
Cyren	W32/MSIL_Kryptik.BFZ.gen!Eldorado
MAX	malware (ai score=88)
Microsoft	Trojan:MSIL/AgentTesla.AX!MTB
Arcabit	Trojan.Generic.D298A9C6
ViRobot	Trojan.Win32.Z.Wacatac.588288.A
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.43559366
AhnLab-V3	Trojan/Win32.MSILKrypt.R346455
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.GenericKD.43559366
Ad-Aware	Trojan.GenericKD.43559366
Malwarebytes	Trojan.PCrypt.MSIL.Generic
ESET-NOD32	a variant of MSIL/Kryptik.XCV
TrendMicro-HouseCall	TROJ_GEN.R002C0WGT20
Yandex	Trojan.AvsArher.bTJEKx
SentinelOne	DFI - Suspicious PE
eGambit	Unsafe.AI_Score_86%
Fortinet	MSIL/Kryptik.XFP!tr
BitDefenderTheta	Gen:NN.ZemsilF.34152.Jm0@aqIke!j
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.c96

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-28 20:45:58

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.