12.0
0-day
50 个模型检测该样本为恶意！
重新分析
更多

19a46210c60e8cb22ba56485dc16876532539f5a98713d16578253fd70649d61

2d293136e4090d079cc76f4c688b221c.exe

分析耗时

87s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AGENSLA AI SCORE=89 AIDETECTVM ALI1000123 ARTEMIS BUORHN CAYNAMER CONFIDENCE FORMBOOK GENERICKD HIGH CONFIDENCE HRPH HRWNNU IGENT MALITRAR MALREP MALWARE2 MALWARE@#RTOANIJLEA0T ODRX PROBABLY HEUR QQPASS QQROB R + MAL R343019 RARAUTORUN REDCAP RUNNER SCORE SUSPICIOUSTROJAN THJOHBO TQA8 UNSAFE YBKPP ZZZOL 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!2D293136E409 20201211 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Alibaba Trojan:Win32/runner.ali1000123 20190527 0.3.0.5
Kingsoft 20201211 2017.9.26.565
Tencent Msil.Trojan-qqpass.Qqrob.Hrph 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_70% (W) 20190702 1.0
静态指标
Queries for the computername (4 个事件)
Time & API Arguments Status Return Repeated
1619341346.300249
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619341348.190249
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619341350.315249
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619341350.581249
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619341295.393626
IsDebuggerPresent
failed 0 0
1619341295.393626
IsDebuggerPresent
failed 0 0
1619341308.456249
IsDebuggerPresent
failed 0 0
1619341308.456249
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619341295.409626
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .gfids
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name PNG
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619341299.237626
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
GlobalFree+0x27 GlobalAlloc-0x11f kernelbase+0x13e88 @ 0x778f3e88
vivvhicaw+0x10ccd @ 0x1030ccd
vivvhicaw+0x7536e @ 0x109536e
vivvhicaw+0x7557a @ 0x109557a
vivvhicaw+0x3fa6 @ 0x1023fa6
vivvhicaw+0x8f8d @ 0x1028f8d
vivvhicaw+0x96f5 @ 0x10296f5
vivvhicaw+0xa2f7 @ 0x102a2f7
vivvhicaw+0x962c @ 0x102962c
vivvhicaw+0xa2f7 @ 0x102a2f7
vivvhicaw+0x962c @ 0x102962c
vivvhicaw+0xa2f7 @ 0x102a2f7
vivvhicaw+0x962c @ 0x102962c
vivvhicaw+0xa2f7 @ 0x102a2f7
vivvhicaw+0x962c @ 0x102962c
vivvhicaw+0xd87e @ 0x102d87e
vivvhicaw+0xd967 @ 0x102d967
vivvhicaw+0x1648e @ 0x103648e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 7267712
registers.edi: 16290696
registers.eax: 49879379
registers.ebp: 7267764
registers.edx: 16290704
registers.ebx: 16290704
registers.esi: 3387864
registers.ecx: 7340032
exception.instruction_r: 8b 46 04 89 45 f4 c6 47 07 80 c6 47 06 00 8b 5e
exception.symbol: RtlInitUnicodeString+0x196 RtlMultiByteToUnicodeN-0x1a7 ntdll+0x2e39e
exception.instruction: mov eax, dword ptr [esi + 4]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189342
exception.address: 0x77d5e39e
success 0 0
1619341350.050249
__exception__
stacktrace: 
0x49be7a5
0x49bdae6
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x736721db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73694a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73694bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73694c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73694c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x7375ce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x7375cf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x7375cda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x7375d199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x7375d09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x737daf00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x73ce55ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73d57f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73d54de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3993980
registers.edi: 1411049973
registers.eax: 0
registers.ebp: 3994024
registers.edx: 8
registers.ebx: 0
registers.esi: 42584592
registers.ecx: 0
exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 dc b8 8f 95 50 29 e9
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x4e22076
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 75 个事件)
Time & API Arguments Status Return Repeated
1619341302.096249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00b70000
success 0 0
1619341302.096249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00bd0000
success 0 0
1619341305.346249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00c60000
success 0 0
1619341305.346249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00cb0000
success 0 0
1619341306.831249
NtProtectVirtualMemory
process_identifier: 3244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73671000
success 0 0
1619341308.456249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02540000
success 0 0
1619341308.456249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x025a0000
success 0 0
1619341308.456249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0099a000
success 0 0
1619341308.503249
NtProtectVirtualMemory
process_identifier: 3244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73672000
success 0 0
1619341308.503249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00992000
success 0 0
1619341313.878249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009a2000
success 0 0
1619341315.393249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009d5000
success 0 0
1619341315.409249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009db000
success 0 0
1619341315.409249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009d7000
success 0 0
1619341318.393249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009a3000
success 0 0
1619341319.425249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009a4000
success 0 0
1619341319.815249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009ac000
success 0 0
1619341320.940249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x049b0000
success 0 0
1619341320.940249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x049b1000
success 0 0
1619341326.909249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009a7000
success 0 0
1619341330.831249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009a8000
success 0 0
1619341330.971249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x049bd000
success 0 0
1619341331.081249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009b6000
success 0 0
1619341331.237249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00cb1000
success 0 0
1619341332.065249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009ba000
success 0 0
1619341332.065249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009b7000
success 0 0
1619341332.518249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d20000
success 0 0
1619341332.518249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d21000
success 0 0
1619341333.112249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d22000
success 0 0
1619341334.440249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x049be000
success 0 0
1619341345.987249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d23000
success 0 0
1619341346.753249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x049bf000
success 0 0
1619341346.753249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d24000
success 0 0
1619341347.143249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d25000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d26000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009ad000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04e10000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04e11000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009aa000
success 0 0
1619341347.284249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009ab000
success 0 0
1619341347.346249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04e20000
success 0 0
1619341347.378249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d27000
success 0 0
1619341347.378249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04e21000
success 0 0
1619341347.737249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d28000
success 0 0
1619341347.753249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d29000
success 0 0
1619341347.768249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04e22000
success 0 0
1619341347.768249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d2a000
success 0 0
1619341347.784249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d2b000
success 0 0
1619341347.815249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef30000
success 0 0
1619341347.815249
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
Creates (office) documents on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\77866122\suolu.xls
file C:\Users\Administrator.Oskar-PC\77866122\wwqo.ppt
Creates executable files on the filesystem (4 个事件)
file C:\Users\Administrator.Oskar-PC\77866122\fueckl.cpl
file C:\Users\Administrator.Oskar-PC\77866122\vivvhicaw.pif
file C:\Users\Administrator.Oskar-PC\77866122\lmgvsjkf.dll
file C:\Users\Administrator.Oskar-PC\77866122\vigg.dll
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\77866122\vivvhicaw.pif
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619341345.800249
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Expresses interest in specific running processes (1 个事件)
process regsvcs.exe
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 2b540458a0f9640bafb98a66ebe9421f71604d64
buffer Buffer with sha1: c854a73f4eea842c773dd5d888f3bbfeff3bd9d2
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619341299.237626
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 5677056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001a8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003d0000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description RegSvcs.exe tried to sleep 2728178 seconds, actually delayed analysis time by 2728178 seconds
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe reg_value C:\Users\ADMINI~1.OSK\77866122\VIVVHI~1.PIF C:\Users\ADMINI~1.OSK\77866122\ilcbxfh.pit
Potential code injection by writing to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619341299.315626
WriteProcessMemory
process_identifier: 3244
buffer: ÿÿÿÿ=ú~ú~(ý~€›mèÿÿ jHâý~±
process_handle: 0x000001a8
base_address: 0x7efde000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3132 called NtSetContextThread to modify thread in remote process 3244
Time & API Arguments Status Return Repeated
1619341299.315626
NtSetContextThread
thread_handle: 0x000001a4
registers.eip: 2010382788
registers.esp: 3997236
registers.edi: 0
registers.eax: 4288062
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3244
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3132 resumed a thread in remote process 3244
Time & API Arguments Status Return Repeated
1619341301.034626
NtResumeThread
thread_handle: 0x000001a4
suspend_count: 1
process_identifier: 3244
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (15 个事件)
Time & API Arguments Status Return Repeated
1619341295.018751
CreateProcessInternalW
thread_identifier: 3136
thread_handle: 0x00000268
process_identifier: 3132
current_directory: C:\Users\Administrator.Oskar-PC\77866122
filepath: C:\Users\Administrator.Oskar-PC\77866122\vivvhicaw.pif
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\77866122\vivvhicaw.pif" ilcbxfh.pit
filepath_r: C:\Users\Administrator.Oskar-PC\77866122\vivvhicaw.pif
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000280
inherit_handles: 0
success 1 0
1619341297.518626
NtResumeThread
thread_handle: 0x00000198
suspend_count: 1
process_identifier: 3132
success 0 0
1619341299.112626
CreateProcessInternalW
thread_identifier: 3248
thread_handle: 0x000001a4
process_identifier: 3244
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\RegSvcs.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000001a8
inherit_handles: 0
success 1 0
1619341299.237626
NtGetContextThread
thread_handle: 0x000001a4
success 0 0
1619341299.237626
NtAllocateVirtualMemory
process_identifier: 3244
region_size: 5677056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001a8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003d0000
success 0 0
1619341299.253626
WriteProcessMemory
process_identifier: 3244
buffer:
process_handle: 0x000001a8
base_address: 0x003d0000
success 1 0
1619341299.315626
WriteProcessMemory
process_identifier: 3244
buffer: ÿÿÿÿ=ú~ú~(ý~€›mèÿÿ jHâý~±
process_handle: 0x000001a8
base_address: 0x7efde000
success 1 0
1619341299.315626
NtSetContextThread
thread_handle: 0x000001a4
registers.eip: 2010382788
registers.esp: 3997236
registers.edi: 0
registers.eax: 4288062
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3244
success 0 0
1619341301.034626
NtResumeThread
thread_handle: 0x000001a4
suspend_count: 1
process_identifier: 3244
success 0 0
1619341308.456249
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 3244
success 0 0
1619341308.659249
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 3244
success 0 0
1619341308.784249
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 3244
success 0 0
1619341347.800249
NtResumeThread
thread_handle: 0x000002e0
suspend_count: 1
process_identifier: 3244
success 0 0
1619341347.846249
NtResumeThread
thread_handle: 0x00000310
suspend_count: 1
process_identifier: 3244
success 0 0
1619341350.300249
NtResumeThread
thread_handle: 0x00000368
suspend_count: 1
process_identifier: 3244
success 0 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43599707
FireEye Generic.mg.2d293136e4090d07
McAfee Artemis!2D293136E409
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.BAT.Crypter.tqa8
K7AntiVirus Trojan ( 0057213c1 )
BitDefender Trojan.GenericKD.43599707
K7GW Trojan ( 0057213c1 )
Cybereason malicious.7630fe
Cyren W32/Trojan.ODRX-0142
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Malware.Generic-9237336-0
Kaspersky Trojan-PSW.MSIL.Agensla.sit
Alibaba Trojan:Win32/runner.ali1000123
NANO-Antivirus Trojan.Win32.Agensla.hrwnnu
Ad-Aware Trojan.GenericKD.43599707
Sophos Mal/Generic-R + Mal/MalitRar-I
Comodo Malware@#rtoanijlea0t
F-Secure Trojan.TR/Redcap.ybkpp
TrendMicro Trojan.Win32.MALREP.THJOHBO
McAfee-GW-Edition BehavesLike.Win32.Suspicioustrojan.tc
Emsisoft Trojan.GenericKD.43599707 (B)
Ikarus Trojan-Spy.FormBook
GData Trojan.GenericKD.43599707
Avira TR/Spy.Agent.zzzol
MAX malware (ai score=89)
Gridinsoft Trojan.Win32.Dropper.oa
Arcabit Trojan.Generic.D299475B
ZoneAlarm Trojan-PSW.MSIL.Agensla.sit
Microsoft VirTool:Win32/VBInject
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R343019
ALYac Trojan.GenericKD.43599707
VBA32 Trojan.Caynamer
Malwarebytes Trojan.Dropper.SFX
Panda Trj/CI.A
Zoner Probably Heur.RARAutorun
ESET-NOD32 MSIL/Spy.Agent.AES
TrendMicro-HouseCall Trojan.Win32.MALREP.THJOHBO
Tencent Msil.Trojan-qqpass.Qqrob.Hrph
Yandex Trojan.Igent.bUorHN.7
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (W)
Qihoo-360 Generic/Trojan.PSW.b79
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-04-28 04:03:27

Imports

Library KERNEL32.dll:
• 0x430000 GetLastError
• 0x430004 SetLastError
• 0x430008 GetCurrentProcess
• 0x43000c DeviceIoControl
• 0x430010 SetFileTime
• 0x430014 CloseHandle
• 0x430018 CreateDirectoryW
• 0x43001c RemoveDirectoryW
• 0x430020 CreateFileW
• 0x430024 DeleteFileW
• 0x430028 CreateHardLinkW
• 0x43002c GetShortPathNameW
• 0x430030 GetLongPathNameW
• 0x430034 MoveFileW
• 0x430038 GetFileType
• 0x43003c GetStdHandle
• 0x430040 WriteFile
• 0x430044 ReadFile
• 0x430048 FlushFileBuffers
• 0x43004c SetEndOfFile
• 0x430050 SetFilePointer
• 0x430054 SetFileAttributesW
• 0x430058 GetFileAttributesW
• 0x43005c FindClose
• 0x430060 FindFirstFileW
• 0x430064 FindNextFileW
• 0x430068 GetVersionExW
• 0x430070 GetFullPathNameW
• 0x430074 FoldStringW
• 0x430078 GetModuleFileNameW
• 0x43007c GetModuleHandleW
• 0x430080 FindResourceW
• 0x430084 FreeLibrary
• 0x430088 GetProcAddress
• 0x43008c GetCurrentProcessId
• 0x430090 ExitProcess
• 0x430098 Sleep
• 0x43009c LoadLibraryW
• 0x4300a0 GetSystemDirectoryW
• 0x4300a4 CompareStringW
• 0x4300a8 AllocConsole
• 0x4300ac FreeConsole
• 0x4300b0 AttachConsole
• 0x4300b4 WriteConsoleW
• 0x4300bc CreateThread
• 0x4300c0 SetThreadPriority
• 0x4300d4 SetEvent
• 0x4300d8 ResetEvent
• 0x4300dc ReleaseSemaphore
• 0x4300e0 WaitForSingleObject
• 0x4300e4 CreateEventW
• 0x4300e8 CreateSemaphoreW
• 0x4300ec GetSystemTime
• 0x430108 GetCPInfo
• 0x43010c IsDBCSLeadByte
• 0x430110 MultiByteToWideChar
• 0x430114 WideCharToMultiByte
• 0x430118 GlobalAlloc
• 0x43011c GetTickCount
• 0x430120 LockResource
• 0x430124 GlobalLock
• 0x430128 GlobalUnlock
• 0x43012c GlobalFree
• 0x430130 LoadResource
• 0x430134 SizeofResource
• 0x43013c GetExitCodeProcess
• 0x430140 GetLocalTime
• 0x430144 MapViewOfFile
• 0x430148 UnmapViewOfFile
• 0x43014c CreateFileMappingW
• 0x430150 OpenFileMappingW
• 0x430154 GetCommandLineW
• 0x430160 GetTempPathW
• 0x430164 MoveFileExW
• 0x430168 GetLocaleInfoW
• 0x43016c GetTimeFormatW
• 0x430170 GetDateFormatW
• 0x430174 GetNumberFormatW
• 0x430178 SetFilePointerEx
• 0x43017c GetConsoleMode
• 0x430180 GetConsoleCP
• 0x430184 HeapSize
• 0x430188 SetStdHandle
• 0x43018c GetProcessHeap
• 0x430190 RaiseException
• 0x430194 GetSystemInfo
• 0x430198 VirtualProtect
• 0x43019c VirtualQuery
• 0x4301a0 LoadLibraryExA
• 0x4301a8 IsDebuggerPresent
• 0x4301b4 GetStartupInfoW
• 0x4301bc GetCurrentThreadId
• 0x4301c4 InitializeSListHead
• 0x4301c8 TerminateProcess
• 0x4301cc RtlUnwind
• 0x4301d0 EncodePointer
• 0x4301d8 TlsAlloc
• 0x4301dc TlsGetValue
• 0x4301e0 TlsSetValue
• 0x4301e4 TlsFree
• 0x4301e8 LoadLibraryExW
• 0x4301f0 GetModuleHandleExW
• 0x4301f4 GetModuleFileNameA
• 0x4301f8 GetACP
• 0x4301fc HeapFree
• 0x430200 HeapAlloc
• 0x430204 HeapReAlloc
• 0x430208 GetStringTypeW
• 0x43020c LCMapStringW
• 0x430210 FindFirstFileExA
• 0x430214 FindNextFileA
• 0x430218 IsValidCodePage
• 0x43021c GetOEMCP
• 0x430220 GetCommandLineA
• 0x43022c DecodePointer
Library gdiplus.dll:
• 0x430234 GdiplusShutdown
• 0x430238 GdiplusStartup
• 0x430248 GdipDisposeImage
• 0x43024c GdipCloneImage
• 0x430250 GdipFree
• 0x430254 GdipAlloc

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.