SmartHawk

14.8

0-day

该样本未表现出任何异常！

重新分析

下载样本

40416b7202af7f08da4247ba4476c05deb3dff3ce0d4fed0b5a85de08cc70305

3f10868068d7f01e2596422e783e064d.exe

分析耗时

88s

最近分析

文件大小

224.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392744.257751 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619392765.929249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392722.038626 IsDebuggerPresent		failed	0	0
1619392755.569501 IsDebuggerPresent		failed	0	0

Command line console output was observed (3 个事件)

Time & API	Arguments	Status	Return
1619392749.600751 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\qYwLHUWK"。 console_handle: 0x00000007	success	1
1619392765.944249 WriteConsoleW	buffer: 错误: console_handle: 0x0000000b	success	1
1619392765.960249 WriteConsoleW	buffer: 当文件已存在时，无法创建该文件。 console_handle: 0x0000000b	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392765.710501 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 个事件)

domain

mmiri1.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 个事件)

Time & API	Arguments	Status
1619392720.694626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x008e0000	success
1619392720.694626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a70000	success
1619392722.022626 NtProtectVirtualMemory	process_identifier: 1436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619392722.054626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0033a000	success
1619392722.054626 NtProtectVirtualMemory	process_identifier: 1436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619392722.054626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00332000	success
1619392722.350626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00382000	success
1619392722.413626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00383000	success
1619392722.429626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003bb000	success
1619392722.429626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success
1619392722.429626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038c000	success
1619392722.757626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00384000	success
1619392722.757626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00385000	success
1619392722.757626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00386000	success
1619392722.757626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00760000	success
1619392722.913626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success
1619392722.913626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00397000	success
1619392722.913626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success
1619392722.913626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0033b000	success
1619392722.975626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00761000	success
1619392723.288626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00387000	success
1619392723.304626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00396000	success
1619392725.397626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a71000	success
1619392725.600626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076a000	success
1619392725.663626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00388000	success
1619392725.694626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x049c0000	success
1619392725.694626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b20000	success
1619392725.694626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b21000	success
1619392725.710626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b22000	success
1619392725.725626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b23000	success
1619392725.725626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b24000	success
1619392725.725626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b28000	success
1619392725.725626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00389000	success
1619392726.022626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076b000	success
1619392726.038626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b2d000	success
1619392726.038626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b31000	success
1619392726.179626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076c000	success
1619392726.538626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success
1619392727.413626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b5000	success
1619392729.725626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038a000	success
1619392732.022626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x046f0000	success
1619392743.147626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076d000	success
1619392743.366626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x046f1000	success
1619392744.069626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00333000	success
1619392751.741626 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0038b000	success
1619392755.554501 NtAllocateVirtualMemory	process_identifier: 3196 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004b0000	success
1619392755.554501 NtAllocateVirtualMemory	process_identifier: 3196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success
1619392755.569501 NtProtectVirtualMemory	process_identifier: 3196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619392755.569501 NtAllocateVirtualMemory	process_identifier: 3196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success
1619392755.569501 NtProtectVirtualMemory	process_identifier: 3196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs

Creates a suspicious process (5 个事件)

cmdline	schtasks.exe /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp"
cmdline	"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
cmdline	schtasks.exe /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp"

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs

A process created a hidden window (4 个事件)

Time & API	Arguments	Status	Return
1619392744.007626 ShellExecuteExW	parameters: /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1
1619392752.460499 ShellExecuteExW	parameters: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs show_type: 0	success	1
1619392754.335751 ShellExecuteExW	parameters: /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe" filepath: cmd filepath_r: cmd show_type: 0	success	1
1619392765.757501 ShellExecuteExW	parameters: /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.170005548892047

section

{'size_of_data': '0x00035000', 'virtual_address': '0x00002000', 'entropy': 7.170005548892047, 'name': '.text', 'virtual_size': '0x00034ba4'}

description

A section with a high entropy has been found

entropy

0.9636363636363636

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392751.741626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392751.819626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 472 process_handle: 0x000003a0	failed	0	0
1619392751.819626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 472 process_handle: 0x000003a0	success	0	0

Uses Windows utilities for basic Windows functionality (4 个事件)

cmdline	schtasks.exe /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp"
cmdline	schtasks.exe /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp"

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: 68df9249860696823c29d6996c75391da969023d

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (3 个事件)

Time & API	Arguments	Status	Return
1619392751.585626 NtAllocateVirtualMemory	process_identifier: 472 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619392751.835626 NtAllocateVirtualMemory	process_identifier: 1544 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000039c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619392766.100501 NtAllocateVirtualMemory	process_identifier: 3384 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0

Installs itself for autorun at Windows startup (2 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remcos				reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remcos				reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1436 manipulating memory of non-child process 472
1619392751.585626 NtAllocateVirtualMemory	process_identifier: 472 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: @ process_handle: 0x0000039c base_address: 0x7efde008	success	1	0
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: @ process_handle: 0x00000398 base_address: 0x7efde008	success	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392766.288626 SetWindowsHookExA	thread_identifier: 0 callback_function: 0x004051ae module_address: 0x00000000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	262511	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1436 called NtSetContextThread to modify thread in remote process 1544
Process injection	Process 3196 called NtSetContextThread to modify thread in remote process 3384
1619392751.866626 NtSetContextThread	thread_handle: 0x000003a0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274820 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1544	success	0	0
1619392766.100501 NtSetContextThread	thread_handle: 0x00000340 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274820 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3384	success	0	0

One or more non-safelisted processes were created (2 个事件)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
parent_process	wscript.exe				martian_process	cmd /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1436 resumed a thread in remote process 1544
Process injection	Process 3196 resumed a thread in remote process 3384
1619392751.929626 NtResumeThread	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 1544	success	0	0
1619392766.132501 NtResumeThread	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 3384	success	0	0

Executed a process and injected code into it, probably while unpacking (41 个事件)

Time & API	Arguments	Status	Return
1619392722.038626 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1436	success	0
1619392722.100626 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1436	success	0
1619392743.225626 NtResumeThread	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 1436	success	0
1619392744.007626 CreateProcessInternalW	thread_identifier: 2732 thread_handle: 0x00000350 process_identifier: 1108 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpDD1C.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000388 inherit_handles: 0	success	1
1619392751.585626 CreateProcessInternalW	thread_identifier: 1344 thread_handle: 0x00000344 process_identifier: 472 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f10868068d7f01e2596422e783e064d.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f10868068d7f01e2596422e783e064d.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x00000398 inherit_handles: 0	success	1
1619392751.585626 NtGetContextThread	thread_handle: 0x00000344	success	0
1619392751.585626 NtAllocateVirtualMemory	process_identifier: 472 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619392751.835626 CreateProcessInternalW	thread_identifier: 2412 thread_handle: 0x000003a0 process_identifier: 1544 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f10868068d7f01e2596422e783e064d.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f10868068d7f01e2596422e783e064d.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x0000039c inherit_handles: 0	success	1
1619392751.835626 NtGetContextThread	thread_handle: 0x000003a0	success	0
1619392751.835626 NtAllocateVirtualMemory	process_identifier: 1544 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000039c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619392751.835626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x00400000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x00401000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x00414000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x0041a000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x0041c000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: process_handle: 0x0000039c base_address: 0x0041d000	success	1
1619392751.866626 WriteProcessMemory	process_identifier: 1544 buffer: @ process_handle: 0x0000039c base_address: 0x7efde008	success	1
1619392751.866626 NtSetContextThread	thread_handle: 0x000003a0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274820 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1544	success	0
1619392751.929626 NtResumeThread	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 1544	success	0
1619392751.944626 NtResumeThread	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 1436	success	0
1619392752.304499 NtResumeThread	thread_handle: 0x000001e0 suspend_count: 1 process_identifier: 1544	success	0
1619392752.460499 CreateProcessInternalW	thread_identifier: 2856 thread_handle: 0x00000234 process_identifier: 1244 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x0000022c inherit_handles: 0	success	1
1619392754.335751 CreateProcessInternalW	thread_identifier: 3116 thread_handle: 0x000002ac process_identifier: 3112 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000002f4 inherit_handles: 0	success	1
1619392755.413001 CreateProcessInternalW	thread_identifier: 3200 thread_handle: 0x00000080 process_identifier: 3196 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000084 inherit_handles: 1	success	1
1619392755.569501 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 3196	success	0
1619392755.585501 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 3196	success	0
1619392765.710501 NtResumeThread	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 3196	success	0
1619392765.757501 CreateProcessInternalW	thread_identifier: 3288 thread_handle: 0x0000034c process_identifier: 3284 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYwLHUWK" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3493.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000388 inherit_handles: 0	success	1
1619392766.100501 CreateProcessInternalW	thread_identifier: 3388 thread_handle: 0x00000340 process_identifier: 3384 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x00000398 inherit_handles: 0	success	1
1619392766.100501 NtGetContextThread	thread_handle: 0x00000340	success	0
1619392766.100501 NtAllocateVirtualMemory	process_identifier: 3384 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x00400000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x00401000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x00414000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x0041a000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x0041c000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: process_handle: 0x00000398 base_address: 0x0041d000	success	1
1619392766.100501 WriteProcessMemory	process_identifier: 3384 buffer: @ process_handle: 0x00000398 base_address: 0x7efde008	success	1
1619392766.100501 NtSetContextThread	thread_handle: 0x00000340 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274820 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3384	success	0
1619392766.132501 NtResumeThread	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 3384	success	0
1619392766.132501 NtResumeThread	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 3196	success	0

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 个事件)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	142.250.204.46:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-04 05:14:15

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 142.250.204.46	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
mmiri1.ddns.net	A 0.0.0.0	0.0.0.0
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.