SmartHawk

8.4

高危

56 个模型检测该样本为恶意！

重新分析

下载样本

ccba611478fa18915fd3f253146333cc426f9574337606149ab2ab104efddcd6

2bf9c58541201446d889bff20ccccea6.exe

分析耗时

89s

最近分析

文件大小

116.0KB

静态报毒动态报毒 AI SCORE=89 AIDETECTVM ATTRIBUTE BEBP CONFIDENCE FSJZ GENCIRC GENKRYPTIK HDWC HIGH CONFIDENCE HIGHCONFIDENCE HKYQQI HPGEN HU0@AONG01NJ INJECT3 KCLOUD KRYPTIK MALWARE1 MALWARE@#36H0IT5GL14CQ MIDIE MXRESICN NVVXH PROXYGATE QVM10 SCORE STATIC AI SUSPICIOUS PE TRICKBOT TROJANX UEGF UNSAFE VRR3YWLRCCV WACATAC XMP3XOGD0S8 ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trickbot-FSJZ!2BF9C5854120	20201211	6.0.6.653
Alibaba	Trojan:Win32/Trickbot.bf6bf7cf	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Tencent	Malware.Win32.Gencirc.10cdd22a	20201211	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619349956.503875 GlobalMemoryStatusEx		success	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

DEC

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619349956.472875 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00410000	success	0	0
1619349956.75375 NtProtectVirtualMemory	process_identifier: 1380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success	0	0

Foreign language identified in PE resource (1 个事件)

name

RT_VERSION

language

LANG_CHINESE

offset

0x0001fe48

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000002d8

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619349956.76975 NtProtectVirtualMemory	process_identifier: 1380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003e0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.936464798019348

section

{'size_of_data': '0x00008400', 'virtual_address': '0x00018000', 'entropy': 7.936464798019348, 'name': '.rsrc', 'virtual_size': '0x0000829d'}

description

A section with a high entropy has been found

entropy

0.28695652173913044

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2288 called NtSetContextThread to modify thread in remote process 1380
1619349956.535875 NtSetContextThread	thread_handle: 0x000000e8 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4260288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1380	success	0	0

Executed a process and injected code into it, probably while unpacking (4 个事件)

Time & API	Arguments	Status	Return
1619349956.503875 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2288	success	0
1619349956.519875 CreateProcessInternalW	thread_identifier: 1376 thread_handle: 0x000000e8 process_identifier: 1380 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2bf9c58541201446d889bff20ccccea6.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000000ec inherit_handles: 0	success	1
1619349956.519875 NtGetContextThread	thread_handle: 0x000000e8	success	0
1619349956.535875 NtSetContextThread	thread_handle: 0x000000e8 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4260288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1380	success	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Midie.72745
FireEye	Generic.mg.2bf9c58541201446
McAfee	Trickbot-FSJZ!2BF9C5854120
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2040143
Sangfor	Malware
K7AntiVirus	Trojan ( 00567d551 )
Alibaba	Trojan:Win32/Trickbot.bf6bf7cf
K7GW	Trojan ( 00567d551 )
Arcabit	Trojan.Midie.D11C29
Cyren	W32/Trojan.UEGF-0645
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Inject.pef
BitDefender	Gen:Variant.Midie.72745
NANO-Antivirus	Trojan.Win32.Inject3.hkyqqi
Avast	Win32:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10cdd22a
Ad-Aware	Gen:Variant.Midie.72745
Emsisoft	Gen:Variant.Midie.72745 (B)
Comodo	Malware@#36h0it5gl14cq
F-Secure	Trojan.TR/Kryptik.nvvxh
DrWeb	Trojan.Inject3.40939
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Mal_HPGen-37b
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Inject.bebp
Avira	TR/Kryptik.nvvxh
Antiy-AVL	Trojan[Downloader]/Win32.Adload
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Trickbot.PVB!MTB
ZoneAlarm	HEUR:Trojan.Win32.Inject.pef
GData	Gen:Variant.Midie.72745
Cynet	Malicious (score: 100)
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34670.hu0@aOng01nj
ALYac	Gen:Variant.Midie.72745
MAX	malware (ai score=89)
VBA32	Trojan.Wacatac
Malwarebytes	Adware.ProxyGate
ESET-NOD32	a variant of Win32/Kryptik.HDWC
TrendMicro-HouseCall	Mal_HPGen-37b
Rising	Trojan.GenKryptik!8.AA55 (TFE:5:vRR3ywlRccV)
Yandex	Trojan.GenKryptik!xmP3XoGD0s8
Ikarus	Trojan-Downloader.Win32.VB

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-01 16:19:00

Imports

Library COMDLG32.dll:

• 0x40a000 ChooseColorW

• 0x40a004 FindTextA

Library CRYPT32.dll:

• 0x40a00c CryptMsgGetParam

• 0x40a010 CertSerializeCertificateStoreElement

• 0x40a014 CryptRegisterOIDFunction

• 0x40a018 CertAddEnhancedKeyUsageIdentifier

• 0x40a01c CertCloseStore

Library WINMM.dll:

• 0x40a14c mixerGetControlDetailsW

• 0x40a150 midiInAddBuffer

• 0x40a154 midiInMessage

• 0x40a158 mmioSetInfo

Library MSACM32.dll:

• 0x40a12c acmFilterChooseW

• 0x40a130 acmFormatChooseW

• 0x40a134 acmFilterTagDetailsA

Library msi.dll:

• 0x40a160

• 0x40a164

• 0x40a168

• 0x40a16c

• 0x40a170

Library NETAPI32.dll:

• 0x40a13c NetDfsGetInfo

• 0x40a140 NetServerComputerNameAdd

• 0x40a144 NetServerTransportAddEx

Library rtutils.dll:

• 0x40a178 TraceGetConsoleW

• 0x40a17c RouterLogEventW

• 0x40a180 LogErrorW

• 0x40a184 LogEventW

Library KERNEL32.dll:

• 0x40a024 WriteConsoleW

• 0x40a028 SetStdHandle

• 0x40a02c CloseHandle

• 0x40a030 LCMapStringEx

• 0x40a034 HeapSize

• 0x40a038 SetFilePointerEx

• 0x40a03c GetStringTypeW

• 0x40a040 HeapReAlloc

• 0x40a044 HeapAlloc

• 0x40a048 GetConsoleMode

• 0x40a04c GetConsoleCP

• 0x40a050 FlushFileBuffers

• 0x40a054 LoadLibraryW

• 0x40a058 OutputDebugStringW

• 0x40a05c LoadLibraryExW

• 0x40a060 VirtualProtect

• 0x40a064 IsDebuggerPresent

• 0x40a068 IsProcessorFeaturePresent

• 0x40a06c GetCommandLineA

• 0x40a070 UnhandledExceptionFilter

• 0x40a074 SetUnhandledExceptionFilter

• 0x40a078 FlsAlloc

• 0x40a07c FlsGetValue

• 0x40a080 FlsSetValue

• 0x40a084 FlsFree

• 0x40a088 GetCurrentProcess

• 0x40a08c TerminateProcess

• 0x40a090 GetStartupInfoW

• 0x40a094 GetModuleHandleW

• 0x40a098 GetProcAddress

• 0x40a09c EncodePointer

• 0x40a0a0 DecodePointer

• 0x40a0a4 EnterCriticalSection

• 0x40a0a8 LeaveCriticalSection

• 0x40a0ac GetLastError

• 0x40a0b0 SetLastError

• 0x40a0b4 InterlockedIncrement

• 0x40a0b8 InterlockedDecrement

• 0x40a0bc GetCurrentThreadId

• 0x40a0c0 ExitProcess

• 0x40a0c4 GetModuleHandleExW

• 0x40a0c8 MultiByteToWideChar

• 0x40a0cc GetStdHandle

• 0x40a0d0 WriteFile

• 0x40a0d4 GetModuleFileNameW

• 0x40a0d8 GetProcessHeap

• 0x40a0dc GetFileType

• 0x40a0e0 InitializeCriticalSectionAndSpinCount

• 0x40a0e4 DeleteCriticalSection

• 0x40a0e8 InitOnceExecuteOnce

• 0x40a0ec GetModuleFileNameA

• 0x40a0f0 QueryPerformanceCounter

• 0x40a0f4 GetSystemTimeAsFileTime

• 0x40a0f8 GetTickCount64

• 0x40a0fc GetEnvironmentStringsW

• 0x40a100 FreeEnvironmentStringsW

• 0x40a104 WideCharToMultiByte

• 0x40a108 HeapFree

• 0x40a10c Sleep

• 0x40a110 IsValidCodePage

• 0x40a114 GetACP

• 0x40a118 GetOEMCP

• 0x40a11c GetCPInfo

• 0x40a120 RtlUnwind

• 0x40a124 CreateFileW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.160.78	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.