8.2
高危
53 个模型检测该样本为恶意！
重新分析
更多

74a607088953838fda8cee4cdf516f68aeaf6a3ae6d1caf23c6aef4ca7f76e87

3436141043eba57c1f84eb15a2851302.exe

分析耗时

71s

最近分析

文件大小

536.5KB
静态报毒 动态报毒 AGENSLA AGENTTESLA AI SCORE=86 ATTRIBUTE AVSARHER BUBVUR CONFIDENCE DOWNLOADER34 ELDORADO ENTS FAREIT GENERICKD GENKRYPTIK GENOME GVLAI@0 HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HM0@AOXPIFI IDCWS KRYPT KRYPTIK LHNA MALICIOUS PE MALWAREX MXRESICN QQPASS QQROB R03FC0PHU20 SCORE TROJANPSW UNSAFE YMACCO ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FYV!3436141043EB 20200906 6.0.6.653
Alibaba TrojanPSW:MSIL/Agensla.d71c7ec2 20190527 0.3.0.5
Avast Win32:MalwareX-gen [Trj] 20200906 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200906 2013.8.14.323
Tencent Msil.Trojan-qqpass.Qqrob.Lhna 20200906 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619354638.688126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (10 个事件)
Time & API Arguments Status Return Repeated
1619345032.243829
IsDebuggerPresent
failed 0 0
1619345074.430829
IsDebuggerPresent
failed 0 0
1619345074.915829
IsDebuggerPresent
failed 0 0
1619345075.430829
IsDebuggerPresent
failed 0 0
1619345075.915829
IsDebuggerPresent
failed 0 0
1619345076.430829
IsDebuggerPresent
failed 0 0
1619345076.915829
IsDebuggerPresent
failed 0 0
1619345077.430829
IsDebuggerPresent
failed 0 0
1619345077.915829
IsDebuggerPresent
failed 0 0
1619345078.430829
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619354639.266126
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\iXRugV"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619345032.993829
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 95 个事件)
Time & API Arguments Status Return Repeated
1619345031.446829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00450000
success 0 0
1619345031.446829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004b0000
success 0 0
1619345032.118829
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619345032.258829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048a000
success 0 0
1619345032.258829
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619345032.258829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00482000
success 0 0
1619345032.571829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00492000
success 0 0
1619345032.790829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00493000
success 0 0
1619345032.805829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0050b000
success 0 0
1619345032.805829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00507000
success 0 0
1619345032.883829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0049c000
success 0 0
1619345032.930829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b80000
success 0 0
1619345032.977829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b81000
success 0 0
1619345032.993829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b82000
success 0 0
1619345032.993829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b83000
success 0 0
1619345033.008829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b84000
success 0 0
1619345033.290829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00494000
success 0 0
1619345033.321829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00495000
success 0 0
1619345033.352829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00496000
success 0 0
1619345033.383829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00497000
success 0 0
1619345033.415829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004aa000
success 0 0
1619345033.415829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a7000
success 0 0
1619345033.430829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004fa000
success 0 0
1619345033.540829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00498000
success 0 0
1619345033.571829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b85000
success 0 0
1619345033.618829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048b000
success 0 0
1619345033.727829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a6000
success 0 0
1619345033.774829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f2000
success 0 0
1619345033.821829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00505000
success 0 0
1619345034.227829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b89000
success 0 0
1619345034.243829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b30000
success 0 0
1619345034.274829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8a000
success 0 0
1619345034.305829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8b000
success 0 0
1619345034.415829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00499000
success 0 0
1619345034.493829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04560000
success 0 0
1619345034.493829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0049a000
success 0 0
1619345067.618829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004b1000
success 0 0
1619345067.727829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004fc000
success 0 0
1619345067.790829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047c0000
success 0 0
1619345067.961829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8c000
success 0 0
1619345068.040829
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 328192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x048d0400
failed 3221225550 0
1619345073.805829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8d000
success 0 0
1619345073.836829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047c1000
success 0 0
1619345073.836829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8e000
success 0 0
1619345073.883829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b8f000
success 0 0
1619345073.915829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047e0000
success 0 0
1619345073.993829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047e1000
success 0 0
1619345074.196829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047e2000
success 0 0
1619345074.274829
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047e3000
success 0 0
1619345074.290829
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x048d0178
failed 3221225550 0
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619345075.024829
ShellExecuteExW
parameters: /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.8650473621256936 section {'size_of_data': '0x00081c00', 'virtual_address': '0x00002000', 'entropy': 7.8650473621256936, 'name': '.text', 'virtual_size': '0x00081a14'} description A section with a high entropy has been found
entropy 0.9682835820895522 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619345068.040829
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (10 个事件)
Time & API Arguments Status Return Repeated
1619345077.711829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1060
process_handle: 0x00011538
failed 0 0
1619345077.711829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1060
process_handle: 0x00011538
success 0 0
1619345078.008829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 176
process_handle: 0x0001153c
failed 0 0
1619345078.008829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 176
process_handle: 0x0001153c
success 0 0
1619345078.321829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1832
process_handle: 0x00011540
failed 0 0
1619345078.321829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1832
process_handle: 0x00011540
success 0 0
1619345078.602829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2944
process_handle: 0x00011544
failed 0 0
1619345078.602829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2944
process_handle: 0x00011544
success 0 0
1619345078.883829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1888
process_handle: 0x00011548
failed 0 0
1619345078.883829
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1888
process_handle: 0x00011548
success 0 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (5 个事件)
Time & API Arguments Status Return Repeated
1619345077.446829
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00011534
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345077.805829
NtAllocateVirtualMemory
process_identifier: 176
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000af14
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.102829
NtAllocateVirtualMemory
process_identifier: 1832
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00008930
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.399829
NtAllocateVirtualMemory
process_identifier: 2944
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00004198
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.696829
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000cd4c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp
Manipulates memory of a non-child process indicative of process injection (10 个事件)
Process injection Process 2344 manipulating memory of non-child process 1060
Process injection Process 2344 manipulating memory of non-child process 176
Process injection Process 2344 manipulating memory of non-child process 1832
Process injection Process 2344 manipulating memory of non-child process 2944
Process injection Process 2344 manipulating memory of non-child process 1888
Time & API Arguments Status Return Repeated
1619345077.446829
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00011534
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345077.805829
NtAllocateVirtualMemory
process_identifier: 176
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000af14
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.102829
NtAllocateVirtualMemory
process_identifier: 1832
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00008930
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.399829
NtAllocateVirtualMemory
process_identifier: 2944
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00004198
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.696829
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000cd4c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Executed a process and injected code into it, probably while unpacking (20 个事件)
Time & API Arguments Status Return Repeated
1619345032.243829
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2344
success 0 0
1619345032.321829
NtResumeThread
thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 2344
success 0 0
1619345074.399829
NtResumeThread
thread_handle: 0x0000b328
suspend_count: 1
process_identifier: 2344
success 0 0
1619345074.415829
NtResumeThread
thread_handle: 0x00008664
suspend_count: 1
process_identifier: 2344
success 0 0
1619345075.024829
CreateProcessInternalW
thread_identifier: 2448
thread_handle: 0x00010b84
process_identifier: 920
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iXRugV" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpFA0A.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00011528
inherit_handles: 0
success 1 0
1619345077.446829
CreateProcessInternalW
thread_identifier: 580
thread_handle: 0x00011508
process_identifier: 1060
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00011534
inherit_handles: 0
success 1 0
1619345077.446829
NtGetContextThread
thread_handle: 0x00011508
success 0 0
1619345077.446829
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00011534
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345077.805829
CreateProcessInternalW
thread_identifier: 3040
thread_handle: 0x00011538
process_identifier: 176
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000af14
inherit_handles: 0
success 1 0
1619345077.805829
NtGetContextThread
thread_handle: 0x00011538
success 0 0
1619345077.805829
NtAllocateVirtualMemory
process_identifier: 176
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000af14
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.102829
CreateProcessInternalW
thread_identifier: 1812
thread_handle: 0x0001153c
process_identifier: 1832
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00008930
inherit_handles: 0
success 1 0
1619345078.102829
NtGetContextThread
thread_handle: 0x0001153c
success 0 0
1619345078.102829
NtAllocateVirtualMemory
process_identifier: 1832
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00008930
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.399829
CreateProcessInternalW
thread_identifier: 2216
thread_handle: 0x00011540
process_identifier: 2944
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00004198
inherit_handles: 0
success 1 0
1619345078.399829
NtGetContextThread
thread_handle: 0x00011540
success 0 0
1619345078.399829
NtAllocateVirtualMemory
process_identifier: 2944
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00004198
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619345078.696829
CreateProcessInternalW
thread_identifier: 1912
thread_handle: 0x00011544
process_identifier: 1888
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3436141043eba57c1f84eb15a2851302.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000cd4c
inherit_handles: 0
success 1 0
1619345078.696829
NtGetContextThread
thread_handle: 0x00011544
success 0 0
1619345078.696829
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000cd4c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader34.29728
MicroWorld-eScan Trojan.GenericKD.43744641
FireEye Generic.mg.3436141043eba57c
McAfee Fareit-FYV!3436141043EB
Cylance Unsafe
Zillya Trojan.Agensla.Win32.5637
AegisLab Trojan.Win32.Malicious.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056a6c01 )
Alibaba TrojanPSW:MSIL/Agensla.d71c7ec2
K7GW Trojan ( 0056a6c01 )
Cybereason malicious.e87d27
Arcabit Trojan.Generic.D29B7D81
TrendMicro TROJ_GEN.R03FC0PHU20
BitDefenderTheta Gen:NN.ZemsilF.34216.Hm0@aOxPIfi
Cyren W32/MSIL_Kryptik.BNB.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/GenKryptik.ENTS
TrendMicro-HouseCall TROJ_GEN.R03FC0PHU20
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.43744641
Avast Win32:MalwareX-gen [Trj]
Ad-Aware Trojan.GenericKD.43744641
Comodo TrojWare.Win32.Genome.gvlai@0
F-Secure Trojan.TR/Kryptik.idcws
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
SentinelOne DFI - Malicious PE
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Krypt
Avira TR/Kryptik.idcws
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Microsoft Trojan:Win32/Ymacco.AA74
ViRobot Trojan.Win32.Z.Genkryptik.549376.E
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKD.43744641
Cynet Malicious (score: 85)
VBA32 CIL.HeapOverride.Heur
ALYac Spyware.AgentTesla
Malwarebytes Spyware.AgentTesla
APEX Malicious
Tencent Msil.Trojan-qqpass.Qqrob.Lhna
Yandex Trojan.AvsArher.bUbVUr
MAX malware (ai score=86)
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/GenKryptik.ENTS!tr
MaxSecure Win.MxResIcn.Heur.Gen
AVG Win32:MalwareX-gen [Trj]
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-28 22:11:44

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 56539 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.