SmartHawk

Time & API	Arguments	Status
1619384498.500125 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023d0000	success
1619394682.568625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00590000	success
1619394682.568625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00620000	success
1619394683.209625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00530000	success
1619394683.209625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success
1619394683.365625 NtProtectVirtualMemory	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x721b1000	success
1619394683.506625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00a20000	success
1619394683.506625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad0000	success
1619394683.521625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057a000	success
1619394683.521625 NtProtectVirtualMemory	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x721b2000	success
1619394683.521625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00572000	success
1619394683.912625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00592000	success
1619394684.006625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b5000	success
1619394684.021625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bb000	success
1619394684.021625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b7000	success
1619394684.193625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00593000	success
1619394684.209625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059c000	success
1619394684.318625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b20000	success
1619394690.896625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00594000	success
1619394691.240625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00596000	success
1619394694.834625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619394694.834625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00598000	success
1619394695.084625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b21000	success
1619394696.974625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005aa000	success
1619394696.974625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a7000	success
1619394700.131625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a6000	success
1619394700.334625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b22000	success
1619394701.803625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059a000	success
1619394702.021625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00599000	success
1619394702.162625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c60000	success
1619394702.240625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b27000	success
1619394702.271625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b28000	success
1619394703.771625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b2a000	success
1619394703.928625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c61000	success
1619394704.021625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c62000	success
1619394704.021625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b2b000	success
1619394704.131625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c63000	success
1619394704.162625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b2c000	success
1619394704.178625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b2f000	success
1619394704.193625 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059d000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rfq.exe

Drops a binary and executes it (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ico.png
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rfq.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rfq.exe

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-08-15 03:15:49

Imports

Library KERNEL32.dll:

• 0x42f000 GetLastError

• 0x42f004 SetLastError

• 0x42f008 GetCurrentProcess

• 0x42f00c DeviceIoControl

• 0x42f010 SetFileTime

• 0x42f014 CloseHandle

• 0x42f018 CreateDirectoryW

• 0x42f01c RemoveDirectoryW

• 0x42f020 CreateFileW

• 0x42f024 DeleteFileW

• 0x42f028 CreateHardLinkW

• 0x42f02c GetShortPathNameW

• 0x42f030 GetLongPathNameW

• 0x42f034 MoveFileW

• 0x42f038 GetFileType

• 0x42f03c GetStdHandle

• 0x42f040 WriteFile

• 0x42f044 ReadFile

• 0x42f048 FlushFileBuffers

• 0x42f04c SetEndOfFile

• 0x42f050 SetFilePointer

• 0x42f054 SetFileAttributesW

• 0x42f058 GetFileAttributesW

• 0x42f05c FindClose

• 0x42f060 FindFirstFileW

• 0x42f064 FindNextFileW

• 0x42f068 GetVersionExW

• 0x42f06c GetCurrentDirectoryW

• 0x42f070 GetFullPathNameW

• 0x42f074 FoldStringW

• 0x42f078 GetModuleFileNameW

• 0x42f07c GetModuleHandleW

• 0x42f080 FindResourceW

• 0x42f084 FreeLibrary

• 0x42f088 GetProcAddress

• 0x42f08c GetCurrentProcessId

• 0x42f090 ExitProcess

• 0x42f094 SetThreadExecutionState

• 0x42f098 Sleep

• 0x42f09c LoadLibraryW

• 0x42f0a0 GetSystemDirectoryW

• 0x42f0a4 CompareStringW

• 0x42f0a8 AllocConsole

• 0x42f0ac FreeConsole

• 0x42f0b0 AttachConsole

• 0x42f0b4 WriteConsoleW

• 0x42f0b8 GetProcessAffinityMask

• 0x42f0bc CreateThread

• 0x42f0c0 SetThreadPriority

• 0x42f0c4 InitializeCriticalSection

• 0x42f0c8 EnterCriticalSection

• 0x42f0cc LeaveCriticalSection

• 0x42f0d0 DeleteCriticalSection

• 0x42f0d4 SetEvent

• 0x42f0d8 ResetEvent

• 0x42f0dc ReleaseSemaphore

• 0x42f0e0 WaitForSingleObject

• 0x42f0e4 CreateEventW

• 0x42f0e8 CreateSemaphoreW

• 0x42f0ec GetSystemTime

• 0x42f0f0 SystemTimeToTzSpecificLocalTime

• 0x42f0f4 TzSpecificLocalTimeToSystemTime

• 0x42f0f8 SystemTimeToFileTime

• 0x42f0fc FileTimeToLocalFileTime

• 0x42f100 LocalFileTimeToFileTime

• 0x42f104 FileTimeToSystemTime

• 0x42f108 GetCPInfo

• 0x42f10c IsDBCSLeadByte

• 0x42f110 MultiByteToWideChar

• 0x42f114 WideCharToMultiByte

• 0x42f118 GlobalAlloc

• 0x42f11c GetTickCount

• 0x42f120 SetCurrentDirectoryW

• 0x42f124 GetExitCodeProcess

• 0x42f128 GetLocalTime

• 0x42f12c MapViewOfFile

• 0x42f130 UnmapViewOfFile

• 0x42f134 CreateFileMappingW

• 0x42f138 OpenFileMappingW

• 0x42f13c GetCommandLineW

• 0x42f140 SetEnvironmentVariableW

• 0x42f144 ExpandEnvironmentStringsW

• 0x42f148 GetTempPathW

• 0x42f14c MoveFileExW

• 0x42f150 GetLocaleInfoW

• 0x42f154 GetTimeFormatW

• 0x42f158 GetDateFormatW

• 0x42f15c GetNumberFormatW

• 0x42f160 RaiseException

• 0x42f164 GetSystemInfo

• 0x42f168 VirtualProtect

• 0x42f16c VirtualQuery

• 0x42f170 LoadLibraryExA

• 0x42f174 IsProcessorFeaturePresent

• 0x42f178 IsDebuggerPresent

• 0x42f17c UnhandledExceptionFilter

• 0x42f180 SetUnhandledExceptionFilter

• 0x42f184 GetStartupInfoW

• 0x42f188 QueryPerformanceCounter

• 0x42f18c GetCurrentThreadId

• 0x42f190 GetSystemTimeAsFileTime

• 0x42f194 InitializeSListHead

• 0x42f198 TerminateProcess

• 0x42f19c RtlUnwind

• 0x42f1a0 EncodePointer

• 0x42f1a4 InitializeCriticalSectionAndSpinCount

• 0x42f1a8 TlsAlloc

• 0x42f1ac TlsGetValue

• 0x42f1b0 TlsSetValue

• 0x42f1b4 TlsFree

• 0x42f1b8 LoadLibraryExW

• 0x42f1bc QueryPerformanceFrequency

• 0x42f1c0 GetModuleHandleExW

• 0x42f1c4 GetModuleFileNameA

• 0x42f1c8 GetACP

• 0x42f1cc HeapFree

• 0x42f1d0 HeapAlloc

• 0x42f1d4 HeapReAlloc

• 0x42f1d8 GetStringTypeW

• 0x42f1dc LCMapStringW

• 0x42f1e0 FindFirstFileExA

• 0x42f1e4 FindNextFileA

• 0x42f1e8 IsValidCodePage

• 0x42f1ec GetOEMCP

• 0x42f1f0 GetCommandLineA

• 0x42f1f4 GetEnvironmentStringsW

• 0x42f1f8 FreeEnvironmentStringsW

• 0x42f1fc GetProcessHeap

• 0x42f200 SetStdHandle

• 0x42f204 HeapSize

• 0x42f208 GetConsoleCP

• 0x42f20c GetConsoleMode

• 0x42f210 SetFilePointerEx

• 0x42f214 DecodePointer

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.25.14	172.217.24.14

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.