12.0
0-day
50 个模型检测该样本为恶意！
重新分析
更多

527553608c9cd2ae82e7c629cc93b32e3d08e77f8e8de49e6dea787a5039c880

2ccd5b1d8c7678141781f212f5699701.exe

分析耗时

101s

最近分析

文件大小

664.5KB
静态报毒 动态报毒 100% AI SCORE=88 ALI1000139 AVSARHER BUBVUR CONFIDENCE ELDORADO FAREIT GENERICKD HIGH CONFIDENCE HSYNXW HVAB KRYPTIK MALICIOUS PE NANOCORE NOON PACKED2 PM0@AUE2AJG R032C0DHQ20 R349158 RNKBEND SCORE SQBDQ@0 STARTER TROJANX UNSAFE ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FXY!2CCD5B1D8C76 20200915 6.0.6.653
Alibaba Trojan:Win32/starter.ali1000139 20190527 0.3.0.5
Avast Win32:TrojanX-gen [Trj] 20200917 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200917 2013.8.14.323
Tencent Msil.Trojan-spy.Noon.Hvab 20200917 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619348197.179125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619348137.789875
IsDebuggerPresent
failed 0 0
1619348137.804875
IsDebuggerPresent
failed 0 0
1619348205.507499
IsDebuggerPresent
failed 0 0
1619348205.507499
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619348204.132125
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\hmmPAvWu"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619348137.820875
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 92 个事件)
Time & API Arguments Status Return Repeated
1619348137.086875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00750000
success 0 0
1619348137.086875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00870000
success 0 0
1619348137.695875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x005b0000
success 0 0
1619348137.695875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00650000
success 0 0
1619348137.742875
NtProtectVirtualMemory
process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619348137.789875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02160000
success 0 0
1619348137.789875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02340000
success 0 0
1619348137.804875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0035a000
success 0 0
1619348137.804875
NtProtectVirtualMemory
process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619348137.804875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00352000
success 0 0
1619348138.023875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a2000
success 0 0
1619348138.132875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d5000
success 0 0
1619348138.148875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003db000
success 0 0
1619348138.148875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d7000
success 0 0
1619348138.336875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a3000
success 0 0
1619348138.367875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003ac000
success 0 0
1619348138.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b0000
success 0 0
1619348138.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a4000
success 0 0
1619348138.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b1000
success 0 0
1619348138.414875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b2000
success 0 0
1619348138.414875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b3000
success 0 0
1619348138.476875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b4000
success 0 0
1619348138.492875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b5000
success 0 0
1619348138.898875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a5000
success 0 0
1619348138.992875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b6000
success 0 0
1619348139.507875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a6000
success 0 0
1619348139.539875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b7000
success 0 0
1619348192.304875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003b6000
success 0 0
1619348192.320875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b8000
success 0 0
1619348192.382875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a7000
success 0 0
1619348192.382875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006b9000
success 0 0
1619348192.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003ba000
success 0 0
1619348192.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003b7000
success 0 0
1619348192.398875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006ba000
success 0 0
1619348192.429875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006bb000
success 0 0
1619348192.711875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a8000
success 0 0
1619348192.726875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006bf000
success 0 0
1619348192.742875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003a9000
success 0 0
1619348192.898875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05080000
success 0 0
1619348192.945875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05082000
success 0 0
1619348192.945875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05083000
success 0 0
1619348192.945875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003ad000
success 0 0
1619348192.945875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05084000
success 0 0
1619348192.945875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05085000
success 0 0
1619348192.961875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05086000
success 0 0
1619348192.961875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05087000
success 0 0
1619348192.961875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05088000
success 0 0
1619348192.961875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05090000
success 0 0
1619348192.992875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05091000
success 0 0
1619348193.023875
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05097000
success 0 0
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619348196.914875
ShellExecuteExW
parameters: /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.887175826854243 section {'size_of_data': '0x000a1a00', 'virtual_address': '0x00002000', 'entropy': 7.887175826854243, 'name': '.text', 'virtual_size': '0x000a1844'} description A section with a high entropy has been found
entropy 0.973644578313253 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619348205.086875
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (4 个事件)
Time & API Arguments Status Return Repeated
1619348205.195875
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 804
process_handle: 0x00000384
failed 0 0
1619348205.195875
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 804
process_handle: 0x00000384
success 0 0
1619348205.242875
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 732
process_handle: 0x0000038c
failed 0 0
1619348205.242875
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 732
process_handle: 0x0000038c
success 0 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (3 个事件)
Time & API Arguments Status Return Repeated
1619348205.070875
NtAllocateVirtualMemory
process_identifier: 804
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000037c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619348205.211875
NtAllocateVirtualMemory
process_identifier: 732
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000380
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619348205.257875
NtAllocateVirtualMemory
process_identifier: 1928
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000388
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Manipulates memory of a non-child process indicative of process injection (4 个事件)
Process injection Process 2136 manipulating memory of non-child process 804
Process injection Process 2136 manipulating memory of non-child process 732
Time & API Arguments Status Return Repeated
1619348205.070875
NtAllocateVirtualMemory
process_identifier: 804
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000037c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619348205.211875
NtAllocateVirtualMemory
process_identifier: 732
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000380
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnù^à  Pîn €@ À@…”nW€8   H.textôN P `.rsrc8€R@@.reloc  X@B
process_handle: 0x00000388
base_address: 0x00400000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer:  €P€8€€h€ €¬Lƒê¬4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation° StringFileInfoè000004b0,FileDescription 0FileVersion0.0.0.0l%InternalNameuaUBAfADXaSLIGyHZnnwEZDxbICVImQQ.exe(LegalCopyright t%OriginalFilenameuaUBAfADXaSLIGyHZnnwEZDxbICVImQQ.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x00000388
base_address: 0x00448000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: ` ð>
process_handle: 0x00000388
base_address: 0x0044a000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: @
process_handle: 0x00000388
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnù^à  Pîn €@ À@…”nW€8   H.textôN P `.rsrc8€R@@.reloc  X@B
process_handle: 0x00000388
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2136 called NtSetContextThread to modify thread in remote process 1928
Time & API Arguments Status Return Repeated
1619348205.257875
NtSetContextThread
thread_handle: 0x0000038c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4484846
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1928
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2136 resumed a thread in remote process 1928
Time & API Arguments Status Return Repeated
1619348205.336875
NtResumeThread
thread_handle: 0x0000038c
suspend_count: 1
process_identifier: 1928
success 0 0
Executed a process and injected code into it, probably while unpacking (24 个事件)
Time & API Arguments Status Return Repeated
1619348137.804875
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2136
success 0 0
1619348137.804875
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 2136
success 0 0
1619348137.820875
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 2136
success 0 0
1619348196.914875
CreateProcessInternalW
thread_identifier: 2184
thread_handle: 0x00000334
process_identifier: 2468
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmmPAvWu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp645D.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x0000036c
inherit_handles: 0
success 1 0
1619348205.054875
CreateProcessInternalW
thread_identifier: 2712
thread_handle: 0x00000328
process_identifier: 804
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x0000037c
inherit_handles: 0
success 1 0
1619348205.070875
NtGetContextThread
thread_handle: 0x00000328
success 0 0
1619348205.070875
NtAllocateVirtualMemory
process_identifier: 804
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000037c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619348205.211875
CreateProcessInternalW
thread_identifier: 1868
thread_handle: 0x00000384
process_identifier: 732
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000380
inherit_handles: 0
success 1 0
1619348205.211875
NtGetContextThread
thread_handle: 0x00000384
success 0 0
1619348205.211875
NtAllocateVirtualMemory
process_identifier: 732
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000380
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619348205.257875
CreateProcessInternalW
thread_identifier: 2316
thread_handle: 0x0000038c
process_identifier: 1928
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2ccd5b1d8c7678141781f212f5699701.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000388
inherit_handles: 0
success 1 0
1619348205.257875
NtGetContextThread
thread_handle: 0x0000038c
success 0 0
1619348205.257875
NtAllocateVirtualMemory
process_identifier: 1928
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000388
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnù^à  Pîn €@ À@…”nW€8   H.textôN P `.rsrc8€R@@.reloc  X@B
process_handle: 0x00000388
base_address: 0x00400000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer:
process_handle: 0x00000388
base_address: 0x00402000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer:  €P€8€€h€ €¬Lƒê¬4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation° StringFileInfoè000004b0,FileDescription 0FileVersion0.0.0.0l%InternalNameuaUBAfADXaSLIGyHZnnwEZDxbICVImQQ.exe(LegalCopyright t%OriginalFilenameuaUBAfADXaSLIGyHZnnwEZDxbICVImQQ.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x00000388
base_address: 0x00448000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: ` ð>
process_handle: 0x00000388
base_address: 0x0044a000
success 1 0
1619348205.257875
WriteProcessMemory
process_identifier: 1928
buffer: @
process_handle: 0x00000388
base_address: 0x7efde008
success 1 0
1619348205.257875
NtSetContextThread
thread_handle: 0x0000038c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4484846
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1928
success 0 0
1619348205.336875
NtResumeThread
thread_handle: 0x0000038c
suspend_count: 1
process_identifier: 1928
success 0 0
1619348205.336875
NtResumeThread
thread_handle: 0x000003a0
suspend_count: 1
process_identifier: 2136
success 0 0
1619348205.507499
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1928
success 0 0
1619348205.507499
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 1928
success 0 0
1619348205.523499
NtResumeThread
thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 1928
success 0 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.Packed2.42555
MicroWorld-eScan Trojan.GenericKD.34422141
FireEye Generic.mg.2ccd5b1d8c767814
CAT-QuickHeal Trojan.Multi
McAfee Fareit-FXY!2CCD5B1D8C76
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2392571
Sangfor Malware
K7AntiVirus Trojan ( 0056d4541 )
Alibaba Trojan:Win32/starter.ali1000139
K7GW Trojan ( 0056d4541 )
Cybereason malicious.7df59b
Arcabit Trojan.Generic.D20D3D7D
Invincea Mal/Generic-S
BitDefenderTheta Gen:NN.ZemsilF.34242.Pm0@aue2Ajg
Cyren W32/MSIL_Agent.BON.gen!Eldorado
Symantec Trojan.Gen.2
TrendMicro-HouseCall TROJ_GEN.R032C0DHQ20
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender Trojan.GenericKD.34422141
NANO-Antivirus Trojan.Win32.Noon.hsynxw
Avast Win32:TrojanX-gen [Trj]
Ad-Aware Trojan.GenericKD.34422141
Comodo TrojWare.Win32.Agent.sqbdq@0
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R032C0DHQ20
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Inject
eGambit Unsafe.AI_Score_97%
MAX malware (ai score=88)
Antiy-AVL Trojan[Spy]/MSIL.Noon
Microsoft Trojan:MSIL/NanoCore.MK!MTB
AegisLab Trojan.MSIL.Noon.l!c
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
GData Trojan.GenericKD.34422141
AhnLab-V3 Trojan/Win32.Kryptik.R349158
ALYac Trojan.GenericKD.34422141
Malwarebytes Trojan.Crypt.MSIL
APEX Malicious
ESET-NOD32 a variant of MSIL/Kryptik.XLH
Tencent Msil.Trojan-spy.Noon.Hvab
Yandex Trojan.AvsArher.bUbVUr
SentinelOne DFI - Malicious PE
Fortinet MSIL/Kryptik.XLH!tr
AVG Win32:TrojanX-gen [Trj]
Panda Trj/RnkBend.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Generic/Trojan.Spy.beb
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-25 16:11:48

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.