SmartHawk

10.2

0-day

52 个模型检测该样本为恶意！

重新分析

下载样本

ce6375b775b9a193e76d8ee3b197e9747468a0e6d3440a65ca2fd50bf664a1a2

2f3375d84fa423a602abeadb13f129e6.exe

分析耗时

90s

最近分析

文件大小

778.0KB

静态报毒动态报毒 100% AI SCORE=81 ATTRIBUTE CLOUD CONFIDENCE CRYPTINJECT ELDORADO FAREIT GDSDA GEN@0 GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HSSP KRYPTIK MALICIOUS PE MSILKRYPT MXRESICN NOON PACKEDNET PALLAS POSSIBLETHREAT PWSX R348272 RAZY SCORE UNCLASSIFIED UNSAFE USXVPHI20 WM0@AMSUJEH WOREFLINT ZEMSILF ZFLNX 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:MSIL/CryptInject.7d6c8dac	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Tencent	Msil.Trojan.Agent.Hssp	20200827	1.0.0.1
Kingsoft		20200827	2013.8.14.323
McAfee	Fareit-FYE!2F3375D84FA4	20200826	6.0.6.653

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363452.648501 IsDebuggerPresent		failed	0	0
1619363452.648501 IsDebuggerPresent		failed	0	0
1619363506.023501 IsDebuggerPresent		failed	0	0
1619363506.508501 IsDebuggerPresent		failed	0	0
1619363507.086751 IsDebuggerPresent		failed	0	0
1619363507.086751 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363452.664501 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 126 个事件)

Time & API	Arguments	Status	Return
1619363451.914501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00560000	success	0
1619363451.914501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success	0
1619363452.523501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003e0000	success	0
1619363452.523501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00410000	success	0
1619363452.570501 NtProtectVirtualMemory	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619363452.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00560000	success	0
1619363452.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success	0
1619363452.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038a000	success	0
1619363452.648501 NtProtectVirtualMemory	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619363452.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00382000	success	0
1619363452.867501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success	0
1619363452.976501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success	0
1619363452.976501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success	0
1619363452.976501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619363453.117501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00393000	success	0
1619363453.164501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039c000	success	0
1619363453.258501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff0000	success	0
1619363453.289501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00394000	success	0
1619363453.304501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff1000	success	0
1619363453.383501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff2000	success	0
1619363454.367501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00395000	success	0
1619363454.758501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00397000	success	0
1619363459.101501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619363459.101501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619363459.383501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff3000	success	0
1619363459.633501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00398000	success	0
1619363459.633501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff5000	success	0
1619363459.773501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00399000	success	0
1619363459.914501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff6000	success	0
1619363460.054501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619363460.117501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d0000	success	0
1619363460.211501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d1000	success	0
1619363460.226501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff7000	success	0
1619363460.242501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d2000	success	0
1619363460.258501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ff8000	success	0
1619363460.258501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039d000	success	0
1619363501.758501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ffb000	success	0
1619363503.195501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038c000	success	0
1619363503.336501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ffc000	success	0
1619363503.570501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d3000	success	0
1619363503.570501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ffd000	success	0
1619363503.617501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ffe000	success	0
1619363503.820501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d4000	success	0
1619363503.820501 NtProtectVirtualMemory	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 268800 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05470400	failed	3221225550
1619363505.617501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fff000	success	0
1619363505.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d90000	success	0
1619363505.648501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d91000	success	0
1619363505.664501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d92000	success	0
1619363505.664501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d93000	success	0
1619363505.726501 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d5000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.899607421669478

section

{'size_of_data': '0x00067600', 'virtual_address': '0x00002000', 'entropy': 7.899607421669478, 'name': '.text', 'virtual_size': '0x00067584'}

description

A section with a high entropy has been found

entropy

0.5318327974276528

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363503.820501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363506.851501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2984 process_handle: 0x0000a7cc	failed	0	0
1619363506.851501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2984 process_handle: 0x0000a7cc	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363506.773501 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00001a98 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619363506.867501 NtAllocateVirtualMemory	process_identifier: 284 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000cb40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 manipulating memory of non-child process 2984
1619363506.773501 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00001a98 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL%kÞ^àL^j @ À@jS H.textdJ L `.rsrcN@@.reloc R@B process_handle: 0x0000cb40 base_address: 0x00400000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: 0HX¤¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNameuzVmxOrSBWjdSpvnkhqLYIsMRakCWA.exe(LegalCopyright p#OriginalFilenameuzVmxOrSBWjdSpvnkhqLYIsMRakCWA.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000cb40 base_address: 0x00448000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: ``: process_handle: 0x0000cb40 base_address: 0x0044a000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: @ process_handle: 0x0000cb40 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL%kÞ^àL^j @ À@jS H.textdJ L `.rsrcN@@.reloc R@B process_handle: 0x0000cb40 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 called NtSetContextThread to modify thread in remote process 284
1619363506.867501 NtSetContextThread	thread_handle: 0x0000a7cc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483678 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 284	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 resumed a thread in remote process 284
1619363506.914501 NtResumeThread	thread_handle: 0x0000a7cc suspend_count: 1 process_identifier: 284	success	0	0

Executed a process and injected code into it, probably while unpacking (23 个事件)

Time & API	Arguments	Status	Return
1619363452.648501 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2764	success	0
1619363452.648501 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2764	success	0
1619363452.664501 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2764	success	0
1619363505.929501 NtResumeThread	thread_handle: 0x00010e5c suspend_count: 1 process_identifier: 2764	success	0
1619363505.976501 NtGetContextThread	thread_handle: 0x00010e5c	success	0
1619363505.976501 NtResumeThread	thread_handle: 0x00010e5c suspend_count: 1 process_identifier: 2764	success	0
1619363505.992501 NtResumeThread	thread_handle: 0x000091c8 suspend_count: 1 process_identifier: 2764	success	0
1619363506.773501 CreateProcessInternalW	thread_identifier: 796 thread_handle: 0x00001a00 process_identifier: 2984 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2f3375d84fa423a602abeadb13f129e6.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2f3375d84fa423a602abeadb13f129e6.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00001a98 inherit_handles: 0	success	1
1619363506.773501 NtGetContextThread	thread_handle: 0x00001a00	success	0
1619363506.773501 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00001a98 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619363506.867501 CreateProcessInternalW	thread_identifier: 1244 thread_handle: 0x0000a7cc process_identifier: 284 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2f3375d84fa423a602abeadb13f129e6.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\2f3375d84fa423a602abeadb13f129e6.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000cb40 inherit_handles: 0	success	1
1619363506.867501 NtGetContextThread	thread_handle: 0x0000a7cc	success	0
1619363506.867501 NtAllocateVirtualMemory	process_identifier: 284 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000cb40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL%kÞ^àL^j @ À@jS H.textdJ L `.rsrcN@@.reloc R@B process_handle: 0x0000cb40 base_address: 0x00400000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: process_handle: 0x0000cb40 base_address: 0x00402000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: 0HX¤¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNameuzVmxOrSBWjdSpvnkhqLYIsMRakCWA.exe(LegalCopyright p#OriginalFilenameuzVmxOrSBWjdSpvnkhqLYIsMRakCWA.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000cb40 base_address: 0x00448000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: ``: process_handle: 0x0000cb40 base_address: 0x0044a000	success	1
1619363506.867501 WriteProcessMemory	process_identifier: 284 buffer: @ process_handle: 0x0000cb40 base_address: 0x7efde008	success	1
1619363506.867501 NtSetContextThread	thread_handle: 0x0000a7cc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483678 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 284	success	0
1619363506.914501 NtResumeThread	thread_handle: 0x0000a7cc suspend_count: 1 process_identifier: 284	success	0
1619363507.086751 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 284	success	0
1619363507.086751 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 284	success	0
1619363507.086751 NtResumeThread	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 284	success	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 85)
FireEye	Generic.mg.2f3375d84fa423a6
CAT-QuickHeal	Trojan.Multi
ALYac	Gen:Variant.Razy.740733
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056cb4e1 )
Alibaba	TrojanSpy:MSIL/CryptInject.7d6c8dac
K7GW	Trojan ( 0056cb4e1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Razy.DB4D7D
TrendMicro	TrojanSpy.Win32.NOON.USXVPHI20
Cyren	W32/MSIL_Kryptik.BKZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Gen:Variant.Razy.740733
ViRobot	Trojan.Win32.Z.Woreflint.796672
MicroWorld-eScan	Gen:Variant.Razy.740733
Tencent	Msil.Trojan.Agent.Hssp
Ad-Aware	Gen:Variant.Razy.740733
Comodo	TrojWare.Win32.Unclassified.gen@0
F-Secure	Trojan.TR/Kryptik.zflnx
DrWeb	Trojan.PackedNET.405
Invincea	heuristic
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Avira	TR/Kryptik.zflnx
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:MSIL/CryptInject.AR!MTB
AegisLab	Trojan.MSIL.Agent.4!c
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Gen:Variant.Razy.740733
AhnLab-V3	Trojan/Win32.MSILKrypt.R348272
McAfee	Fareit-FYE!2F3375D84FA4
MAX	malware (ai score=81)
Malwarebytes	Trojan.MalPack.PNG.Generic
ESET-NOD32	a variant of MSIL/Kryptik.XJJ
TrendMicro-HouseCall	TrojanSpy.Win32.NOON.USXVPHI20
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	PossibleThreat.PALLAS.H
BitDefenderTheta	Gen:NN.ZemsilF.34196.Wm0@amsUJEh
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.9136c5

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-18 14:40:19

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.