SmartHawk

8.0

高危

50 个模型检测该样本为恶意！

重新分析

下载样本

9dd3c076a2e85f8c34caef224c32dc3c9ff2e3d5c00b060a557095b98d751127

38a9e66dcfb9b51c8b0f0e421ee54807.exe

分析耗时

79s

最近分析

文件大小

683.0KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=88 BEQGWDG4R6M CONFIDENCE ELDORADO FAREIT GENERICKD HEAPOVERRIDE HIGH CONFIDENCE HRRPRH KRYPTIK LLRL MALICIOUS PE MALWARE@#1539P9OVT8FQX MALWAREX MSILKRYPT QM0@AQXHWVB QQPASS QQROB R347491 S + TROJ SCORE SIGGEN2 UNSAFE YAKBEEXMSIL ZEMSILF ZFZEX 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXH!38A9E66DCFB9	20201023	6.0.6.653
Alibaba	TrojanSpy:MSIL/AgentTesla.94206637	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
Tencent	Msil.Trojan-qqpass.Qqrob.Llrl	20201023	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619354314.972125 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345032.853776 IsDebuggerPresent		failed	0	0
1619345032.853776 IsDebuggerPresent		failed	0	0
1619345082.040776 IsDebuggerPresent		failed	0	0
1619345082.556776 IsDebuggerPresent		failed	0	0
1619354302.316125 IsDebuggerPresent		failed	0	0
1619354302.316125 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345032.868776 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 个事件)

Time & API	Arguments	Status	Return
1619345032.493776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00710000	success	0
1619345032.493776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00860000	success	0
1619345032.712776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00590000	success	0
1619345032.712776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success	0
1619345032.774776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1619345032.853776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x021d0000	success	0
1619345032.853776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02300000	success	0
1619345032.853776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success	0
1619345032.853776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1619345032.853776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success	0
1619345033.103776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00472000	success	0
1619345033.196776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00595000	success	0
1619345033.196776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success	0
1619345033.196776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success	0
1619345033.321776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00473000	success	0
1619345033.353776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047c000	success	0
1619345033.399776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f0000	success	0
1619345033.415776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00474000	success	0
1619345033.634776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f1000	success	0
1619345033.899776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success	0
1619345033.915776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00476000	success	0
1619345074.946776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f2000	success	0
1619345075.228776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f3000	success	0
1619345075.384776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046c000	success	0
1619345075.399776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f4000	success	0
1619345075.493776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048a000	success	0
1619345075.493776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success	0
1619345075.509776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00486000	success	0
1619345075.509776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f5000	success	0
1619345075.524776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success	0
1619345075.540776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f6000	success	0
1619345075.712776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 296960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e0400	failed	3221225550
1619345081.196776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f7000	success	0
1619345081.196776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00478000	success	0
1619345081.212776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f8000	success	0
1619345081.212776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f9000	success	0
1619345081.337776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007fa000	success	0
1619345081.353776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007fb000	success	0
1619345081.806776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007fc000	success	0
1619345081.837776 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007fd000	success	0
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e0178	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e01a0	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e01c8	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e01f0	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x050e0218	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0512955e	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05129552	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05128c00	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0512956c	failed	3221225550
1619345081.837776 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05129590	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.646774815130328

section

{'size_of_data': '0x000aa200', 'virtual_address': '0x00002000', 'entropy': 7.646774815130328, 'name': '.text', 'virtual_size': '0x000aa0e4'}

description

A section with a high entropy has been found

entropy

0.9970695970695971

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345075.696776 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619354314.597125 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345082.462776 NtAllocateVirtualMemory	process_identifier: 2964 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010f08 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL«õí^àJ~h @ À@(hSð H.textH J `.rsrcðL@@.reloc P@B process_handle: 0x00010f08 base_address: 0x00400000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameTcvkpLpXspxjnycQomZDCZspDq.exe(LegalCopyright hOriginalFilenameTcvkpLpXspxjnycQomZDCZspDq.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00010f08 base_address: 0x00448000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: `8 process_handle: 0x00010f08 base_address: 0x0044a000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: @ process_handle: 0x00010f08 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL«õí^àJ~h @ À@(hSð H.textH J `.rsrcðL@@.reloc P@B process_handle: 0x00010f08 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2056 called NtSetContextThread to modify thread in remote process 2964
1619345082.462776 NtSetContextThread	thread_handle: 0x00001f4c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483198 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2964	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2056 resumed a thread in remote process 2964
1619345082.853776 NtResumeThread	thread_handle: 0x00001f4c suspend_count: 1 process_identifier: 2964	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619345032.853776 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2056	success	0
1619345032.853776 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2056	success	0
1619345032.915776 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2056	success	0
1619345082.009776 NtResumeThread	thread_handle: 0x000094b4 suspend_count: 1 process_identifier: 2056	success	0
1619345082.024776 NtResumeThread	thread_handle: 0x00000b14 suspend_count: 1 process_identifier: 2056	success	0
1619345082.446776 CreateProcessInternalW	thread_identifier: 2968 thread_handle: 0x00001f4c process_identifier: 2964 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\38a9e66dcfb9b51c8b0f0e421ee54807.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\38a9e66dcfb9b51c8b0f0e421ee54807.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00010f08 inherit_handles: 0	success	1
1619345082.462776 NtGetContextThread	thread_handle: 0x00001f4c	success	0
1619345082.462776 NtAllocateVirtualMemory	process_identifier: 2964 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010f08 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL«õí^àJ~h @ À@(hSð H.textH J `.rsrcðL@@.reloc P@B process_handle: 0x00010f08 base_address: 0x00400000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: process_handle: 0x00010f08 base_address: 0x00402000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameTcvkpLpXspxjnycQomZDCZspDq.exe(LegalCopyright hOriginalFilenameTcvkpLpXspxjnycQomZDCZspDq.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00010f08 base_address: 0x00448000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: `8 process_handle: 0x00010f08 base_address: 0x0044a000	success	1
1619345082.462776 WriteProcessMemory	process_identifier: 2964 buffer: @ process_handle: 0x00010f08 base_address: 0x7efde008	success	1
1619345082.462776 NtSetContextThread	thread_handle: 0x00001f4c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483198 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2964	success	0
1619345082.853776 NtResumeThread	thread_handle: 0x00001f4c suspend_count: 1 process_identifier: 2964	success	0
1619354302.316125 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2964	success	0
1619354302.331125 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2964	success	0
1619354302.394125 NtResumeThread	thread_handle: 0x000001a4 suspend_count: 1 process_identifier: 2964	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34340061
FireEye	Generic.mg.38a9e66dcfb9b51c
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FXH!38A9E66DCFB9
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c4581 )
Alibaba	TrojanSpy:MSIL/AgentTesla.94206637
K7GW	Trojan ( 0056c4581 )
CrowdStrike	win/malicious_confidence_80% (W)
Arcabit	Trojan.Generic.D20BFCDD
Cyren	W32/MSIL_Agent.BNZ.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Agensla-9641367-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.34340061
NANO-Antivirus	Trojan.Win32.Agensla.hrrprh
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.34340061
Emsisoft	Trojan.GenericKD.34340061 (B)
Comodo	Malware@#1539p9ovt8fqx
DrWeb	Trojan.PWS.Siggen2.53637
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S + Troj/MSIL-PRD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jc
Sophos	Troj/MSIL-PRD
SentinelOne	DFI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.zfzex
Microsoft	TrojanSpy:MSIL/AgentTesla.AQ!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.34340061
AhnLab-V3	Trojan/Win32.MSILKrypt.R347491
BitDefenderTheta	Gen:NN.ZemsilF.34570.Qm0@aqXHWVb
ALYac	Trojan.MSILKrypt.gen
MAX	malware (ai score=88)
VBA32	CIL.HeapOverride.Heur
ESET-NOD32	a variant of MSIL/Kryptik.XHT
Tencent	Msil.Trojan-qqpass.Qqrob.Llrl
Yandex	Trojan.Kryptik!beQGWDG4r6M
Ikarus	Trojan.Inject
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Kryptik.XHT!tr
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.3f6942
Panda	Trj/CI.A
Qihoo-360	Generic/Trojan.PSW.374

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-11 17:42:02

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702
192.168.56.101	65005	239.255.255.250	3702
192.168.56.101	65007	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.