SmartHawk

12.0

0-day

60 个模型检测该样本为恶意！

重新分析

下载样本

777e4e952b36fb4fc429e8338b14e09de7c0e076ab7aebe944e212c8087cfe39

30545d17881d0c3067ebc371dffa0730.exe

分析耗时

81s

最近分析

文件大小

825.5KB

静态报毒动态报毒 100% 9PHK7M AGENTTESLA AI SCORE=86 AVSARHER BUATV3 CONFIDENCE CRYPTINJECT CRYSAN ELDORADO FAREIT GENERICKD HEAPOVERRIDE HIGH CONFIDENCE HUKCXF KCLOUD KRYPTIK KTSE MALICIOUS PE MALWARE@#2MOK1WICIV6K7 PWSX R350907 S + TROJ SAVE SCORE SIGGEN2 STATIC AI SUSGEN TESLA UNSAFE USXVPI VNGIM ZEMSILF ZM0@AO1RUBJ 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Backdoor:Win32/CryptInject.3c7058fb	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20210224	21.1.5827.0
Kingsoft	Win32.Hack.Undef.(kcloud)	20210224	2017.9.26.565
McAfee	Fareit-FZG!30545D17881D	20210224	6.0.6.653
Tencent		20210224	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620730379.080501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620730380.252501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620730382.220501 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726216.329408 IsDebuggerPresent		failed	0	0
1620726260.064408 IsDebuggerPresent		failed	0	0
1620726260.564408 IsDebuggerPresent		failed	0	0
1620730377.955501 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726217.220408 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (6 个事件)

Time & API	Arguments	Status
1620730382.174501 __exception__	stacktrace: 0x468f415 0x468e8d8 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5698140 registers.edi: 5698168 registers.eax: 0 registers.ebp: 5698184 registers.edx: 158 registers.ebx: 5698380 registers.esi: 40467624 registers.ecx: 0 exception.instruction_r: 8b 01 ff 50 28 89 45 dc b8 56 74 23 4e eb 86 8b exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x468f7a1	success
1620730395.642501 __exception__	stacktrace: 0x51e1b9c 0x468f1ac CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5696660 registers.edi: 42205380 registers.eax: 0 registers.ebp: 5696736 registers.edx: 42243940 registers.ebx: 93271131 registers.esi: 42239488 registers.ecx: 1911774966 exception.instruction_r: 39 00 68 ff ff ff 7f 6a 00 8b 4d c8 e8 4d 9d da exception.instruction: cmp dword ptr [eax], eax exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x535a422	success
1620730396.236501 __exception__	stacktrace: 0x51e1f50 0x468f1ac CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5696660 registers.edi: 42310104 registers.eax: 0 registers.ebp: 5696736 registers.edx: 5696628 registers.ebx: 41748048 registers.esi: 0 registers.ecx: 0 exception.instruction_r: 39 09 e8 c0 70 d0 6c 89 45 b8 b8 00 4b 09 9e 35 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x535d761	success
1620730396.314501 __exception__	stacktrace: 0x51e1fef 0x468f1ac CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5696680 registers.edi: 42316932 registers.eax: 43641326 registers.ebp: 5696736 registers.edx: 8 registers.ebx: 41748048 registers.esi: 436413268 registers.ecx: 0 exception.instruction_r: 8b 01 ff 50 5c 39 00 89 45 c8 69 c6 2d 8f 81 a1 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x535dd17	success
1620730396.955501 __exception__	stacktrace: 0x468f1ac CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5696744 registers.edi: 5697992 registers.eax: 0 registers.ebp: 5698232 registers.edx: 11 registers.ebx: 41748048 registers.esi: 277588187 registers.ecx: 12 exception.instruction_r: 83 78 08 01 0f 9f c0 0f b6 c0 8b 95 50 fa ff ff exception.instruction: cmp dword ptr [eax + 8], 1 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x51e2165	success
1620730397.002501 __exception__	stacktrace: 0x51e28e6 0x468f1ac CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca _CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4 _CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4 _CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 5696624 registers.edi: 42397268 registers.eax: 0 registers.ebp: 5696736 registers.edx: 5696592 registers.ebx: 0 registers.esi: 277588187 registers.ecx: 0 exception.instruction_r: 39 09 e8 9c 54 d0 6c 83 78 04 00 0f 84 1f 04 00 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x535f385	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 168 个事件)

Time & API	Arguments	Status	Return
1620726215.423408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b90000	success	0
1620726215.423408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf0000	success	0
1620726216.032408 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success	0
1620726216.345408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038a000	success	0
1620726216.345408 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success	0
1620726216.345408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00382000	success	0
1620726216.704408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success	0
1620726216.845408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00393000	success	0
1620726216.876408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054b000	success	0
1620726216.876408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success	0
1620726216.954408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039c000	success	0
1620726217.079408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00720000	success	0
1620726217.173408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00721000	success	0
1620726217.189408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00722000	success	0
1620726217.189408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00723000	success	0
1620726217.235408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00724000	success	0
1620726217.532408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00394000	success	0
1620726217.548408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00395000	success	0
1620726217.548408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00396000	success	0
1620726217.610408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00397000	success	0
1620726217.657408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00725000	success	0
1620726217.673408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success	0
1620726217.673408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a7000	success	0
1620726217.689408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success	0
1620726217.704408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038b000	success	0
1620726217.735408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00726000	success	0
1620726217.939408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a6000	success	0
1620726218.032408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00728000	success	0
1620726218.032408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success	0
1620726218.064408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007e0000	success	0
1620726218.079408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00729000	success	0
1620726218.110408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success	0
1620726218.110408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043c000	success	0
1620726218.267408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00398000	success	0
1620726218.267408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00545000	success	0
1620726218.407408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ab000	success	0
1620726218.439408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00383000	success	0
1620726218.439408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072a000	success	0
1620726218.548408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00399000	success	0
1620726218.610408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00960000	success	0
1620726251.845408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf1000	success	0
1620726252.142408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b00000	success	0
1620726252.282408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072b000	success	0
1620726252.360408 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 343040 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b80400	failed	3221225550
1620726258.892408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072c000	success	0
1620726258.907408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072d000	success	0
1620726258.907408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b01000	success	0
1620726258.907408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072e000	success	0
1620726259.048408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072f000	success	0
1620726259.079408 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b70000	success	0

Steals private information from local Internet browsers (7 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.42620463416145

section

{'size_of_data': '0x000cdc00', 'virtual_address': '0x00002000', 'entropy': 7.42620463416145, 'name': '.text', 'virtual_size': '0x000cda94'}

description

A section with a high entropy has been found

entropy

0.9975757575757576

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726252.360408 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1620730382.236501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (4 个事件)

Time & API	Arguments	Status	Return
1620726260.564408 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1812 process_handle: 0x0000a008	failed	0
1620726260.564408 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1812 process_handle: 0x0000a008	success	0
1620730392.705501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2248 process_handle: 0x00000350	failed	0
1620730392.705501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2248 process_handle: 0x00000350	failed	3221225738

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726260.235408 NtAllocateVirtualMemory	process_identifier: 1812 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004720 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1620726260.657408 NtAllocateVirtualMemory	process_identifier: 3008 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000edc0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620730395.486501 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

30545d17881d0c3067ebc371dffa0730.exe tried to sleep 2728205 seconds, actually delayed analysis time by 2728205 seconds

Harvests credentials from local FTP client softwares (5 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 manipulating memory of non-child process 1812
1620726260.235408 NtAllocateVirtualMemory	process_identifier: 1812 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004720 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELdp^à> @ à@èS À H.textD~ `.rsrc @@.relocÀ@B process_handle: 0x0000edc0 base_address: 0x00400000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: 0HX ¤¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h$InternalNamekINJThbbOSnapfWysXWRqeBEYYOZyAD.exe(LegalCopyright p$OriginalFilenamekINJThbbOSnapfWysXWRqeBEYYOZyAD.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000edc0 base_address: 0x0044a000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: @> process_handle: 0x0000edc0 base_address: 0x0044c000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: @ process_handle: 0x0000edc0 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELdp^à> @ à@èS À H.textD~ `.rsrc @@.relocÀ@B process_handle: 0x0000edc0 base_address: 0x00400000	success	1	0

Harvests credentials from local email clients (6 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 called NtSetContextThread to modify thread in remote process 3008
1620726260.673408 NtSetContextThread	thread_handle: 0x0000a008 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4496958 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3008	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 resumed a thread in remote process 3008
1620726260.923408 NtResumeThread	thread_handle: 0x0000a008 suspend_count: 1 process_identifier: 3008	success	0	0

Executed a process and injected code into it, probably while unpacking (25 个事件)

Time & API	Arguments	Status	Return
1620726216.329408 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2248	success	0
1620726216.439408 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2248	success	0
1620726260.017408 NtResumeThread	thread_handle: 0x00005de8 suspend_count: 1 process_identifier: 2248	success	0
1620726260.017408 NtResumeThread	thread_handle: 0x0000d1e4 suspend_count: 1 process_identifier: 2248	success	0
1620726260.235408 CreateProcessInternalW	thread_identifier: 2456 thread_handle: 0x00010a74 process_identifier: 1812 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30545d17881d0c3067ebc371dffa0730.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30545d17881d0c3067ebc371dffa0730.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00004720 inherit_handles: 0	success	1
1620726260.235408 NtGetContextThread	thread_handle: 0x00010a74	success	0
1620726260.235408 NtAllocateVirtualMemory	process_identifier: 1812 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004720 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620726260.657408 CreateProcessInternalW	thread_identifier: 2668 thread_handle: 0x0000a008 process_identifier: 3008 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30545d17881d0c3067ebc371dffa0730.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30545d17881d0c3067ebc371dffa0730.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000edc0 inherit_handles: 0	success	1
1620726260.657408 NtGetContextThread	thread_handle: 0x0000a008	success	0
1620726260.657408 NtAllocateVirtualMemory	process_identifier: 3008 region_size: 319488 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000edc0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELdp^à> @ à@èS À H.textD~ `.rsrc @@.relocÀ@B process_handle: 0x0000edc0 base_address: 0x00400000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: process_handle: 0x0000edc0 base_address: 0x00402000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: 0HX ¤¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h$InternalNamekINJThbbOSnapfWysXWRqeBEYYOZyAD.exe(LegalCopyright p$OriginalFilenamekINJThbbOSnapfWysXWRqeBEYYOZyAD.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000edc0 base_address: 0x0044a000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: @> process_handle: 0x0000edc0 base_address: 0x0044c000	success	1
1620726260.673408 WriteProcessMemory	process_identifier: 3008 buffer: @ process_handle: 0x0000edc0 base_address: 0x7efde008	success	1
1620726260.673408 NtSetContextThread	thread_handle: 0x0000a008 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4496958 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3008	success	0
1620726260.923408 NtResumeThread	thread_handle: 0x0000a008 suspend_count: 1 process_identifier: 3008	success	0
1620730377.955501 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 3008	success	0
1620730377.986501 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 3008	success	0
1620730380.064501 NtResumeThread	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 3008	success	0
1620730380.142501 NtResumeThread	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 3008	success	0
1620730392.705501 NtResumeThread	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 3008	success	0
1620730392.720501 NtResumeThread	thread_handle: 0x00000374 suspend_count: 1 process_identifier: 3008	success	0
1620730393.908501 NtResumeThread	thread_handle: 0x000003c8 suspend_count: 1 process_identifier: 3008	success	0
1620730394.908501 NtResumeThread	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 3008	success	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34489416
FireEye	Generic.mg.30545d17881d0c30
CAT-QuickHeal	Trojan.Agent
ALYac	Spyware.AgentTesla
Cylance	Unsafe
Zillya	Worm.AutoRun.Win32.303
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056de5f1 )
Alibaba	Backdoor:Win32/CryptInject.3c7058fb
K7GW	Trojan ( 0056de5f1 )
Cybereason	malicious.7881d0
Arcabit	Trojan.Generic.D20E4448
BitDefenderTheta	Gen:NN.ZemsilF.34590.Zm0@aO1rUbj
Cyren	W32/MSIL_Kryptik.BOH.gen!Eldorado
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	Backdoor.MSIL.CRYSAN.USXVPI
Avast	Win32:PWSX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
BitDefender	Trojan.GenericKD.34489416
NANO-Antivirus	Trojan.Win32.Crysan.hukcxf
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Crysan.m!c
Rising	Backdoor.Crysan!8.10ECA (KTSE)
Ad-Aware	Trojan.GenericKD.34489416
Emsisoft	Trojan.GenericKD.34489416 (B)
Comodo	Malware@#2mok1wiciv6k7
F-Secure	Trojan.TR/Kryptik.vngim
DrWeb	Trojan.PWS.Siggen2.54621
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.MSIL.CRYSAN.USXVPI
McAfee-GW-Edition	BehavesLike.Win32.Fareit.cc
Sophos	Mal/Generic-S + Troj/Tesla-BP
APEX	Malicious
MaxSecure	Trojan.Malware.74418669.susgen
Avira	TR/Kryptik.vngim
MAX	malware (ai score=86)
Antiy-AVL	Trojan[Backdoor]/MSIL.Crysan
Kingsoft	Win32.Hack.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Agent.oa
Microsoft	Trojan:Win32/CryptInject!MSR
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	Win32.Trojan-Stealer.AgentTesla.9PHK7M
SentinelOne	Static AI - Malicious PE
AhnLab-V3	Trojan/Win32.Kryptik.R350907
McAfee	Fareit-FZG!30545D17881D
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Spyware.AgentTesla
Zoner	Trojan.Win32.97869

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-07 22:28:13

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.