SmartHawk

6.6

高危

该样本未表现出任何异常！

重新分析

下载样本

41355f2507c477d56150ad6facafd27120e0bceb06c905af89748246d3212a9f

40464324d8f44be31215b439cd3c9e9b.exe

分析耗时

79s

最近分析

文件大小

1.0MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (50 out of 93 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421031.877374 IsDebuggerPresent		failed	0	0
1619421031.877374 IsDebuggerPresent		failed	0	0
1619421033.517374 IsDebuggerPresent		failed	0	0
1619421034.017374 IsDebuggerPresent		failed	0	0
1619421034.580374 IsDebuggerPresent		failed	0	0
1619421035.017374 IsDebuggerPresent		failed	0	0
1619421035.580374 IsDebuggerPresent		failed	0	0
1619421036.017374 IsDebuggerPresent		failed	0	0
1619421036.580374 IsDebuggerPresent		failed	0	0
1619421037.017374 IsDebuggerPresent		failed	0	0
1619421037.580374 IsDebuggerPresent		failed	0	0
1619421038.017374 IsDebuggerPresent		failed	0	0
1619421038.580374 IsDebuggerPresent		failed	0	0
1619421039.017374 IsDebuggerPresent		failed	0	0
1619421039.580374 IsDebuggerPresent		failed	0	0
1619421040.017374 IsDebuggerPresent		failed	0	0
1619421040.580374 IsDebuggerPresent		failed	0	0
1619421041.017374 IsDebuggerPresent		failed	0	0
1619421041.580374 IsDebuggerPresent		failed	0	0
1619421042.017374 IsDebuggerPresent		failed	0	0
1619421042.580374 IsDebuggerPresent		failed	0	0
1619421043.017374 IsDebuggerPresent		failed	0	0
1619421043.580374 IsDebuggerPresent		failed	0	0
1619421044.017374 IsDebuggerPresent		failed	0	0
1619421044.580374 IsDebuggerPresent		failed	0	0
1619421045.017374 IsDebuggerPresent		failed	0	0
1619421045.580374 IsDebuggerPresent		failed	0	0
1619421046.017374 IsDebuggerPresent		failed	0	0
1619421046.580374 IsDebuggerPresent		failed	0	0
1619421047.017374 IsDebuggerPresent		failed	0	0
1619421047.580374 IsDebuggerPresent		failed	0	0
1619421048.017374 IsDebuggerPresent		failed	0	0
1619421048.580374 IsDebuggerPresent		failed	0	0
1619421049.017374 IsDebuggerPresent		failed	0	0
1619421049.580374 IsDebuggerPresent		failed	0	0
1619421050.017374 IsDebuggerPresent		failed	0	0
1619421050.580374 IsDebuggerPresent		failed	0	0
1619421051.017374 IsDebuggerPresent		failed	0	0
1619421051.580374 IsDebuggerPresent		failed	0	0
1619421052.017374 IsDebuggerPresent		failed	0	0
1619421052.580374 IsDebuggerPresent		failed	0	0
1619421053.017374 IsDebuggerPresent		failed	0	0
1619421053.580374 IsDebuggerPresent		failed	0	0
1619421054.017374 IsDebuggerPresent		failed	0	0
1619421054.580374 IsDebuggerPresent		failed	0	0
1619421055.017374 IsDebuggerPresent		failed	0	0
1619421055.580374 IsDebuggerPresent		failed	0	0
1619421056.017374 IsDebuggerPresent		failed	0	0
1619421056.580374 IsDebuggerPresent		failed	0	0
1619421057.017374 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421031.892374 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 个事件)

Time & API	Arguments	Status	Return
1619421030.564374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ac0000	success	0
1619421030.564374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ca0000	success	0
1619421031.689374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00470000	success	0
1619421031.689374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d0000	success	0
1619421031.783374 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619421031.877374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00550000	success	0
1619421031.877374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00570000	success	0
1619421031.877374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success	0
1619421031.877374 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619421031.877374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success	0
1619421032.127374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b2000	success	0
1619421032.252374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00515000	success	0
1619421032.252374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051b000	success	0
1619421032.252374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00517000	success	0
1619421032.423374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b3000	success	0
1619421032.439374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bc000	success	0
1619421032.470374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success	0
1619421032.486374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b4000	success	0
1619421032.486374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c1000	success	0
1619421032.517374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c2000	success	0
1619421032.517374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c3000	success	0
1619421032.580374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c4000	success	0
1619421033.002374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success	0
1619421033.080374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c5000	success	0
1619421033.158374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c6000	success	0
1619421033.752374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success	0
1619421033.798374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b8000	success	0
1619421033.845374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c7000	success	0
1619421033.923374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a3000	success	0
1619421033.923374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ac000	success	0
1619421033.923374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c8000	success	0
1619421033.955374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b9000	success	0
1619421033.955374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00980000	success	0
1619421034.033374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00981000	success	0
1619421034.080374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c6000	success	0
1619421034.111374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c9000	success	0
1619421034.111374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ca000	success	0
1619421034.111374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success	0
1619421034.111374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00982000	success	0
1619421034.127374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bd000	success	0
1619421034.142374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006ca000	success	0
1619421034.142374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006cd000	success	0
1619421034.142374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00983000	success	0
1619421075.142374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006ce000	success	0
1619421075.408374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006cf000	success	0
1619421075.627374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a60000	success	0
1619421075.627374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00984000	success	0
1619421075.642374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a61000	success	0
1619421075.752374 NtProtectVirtualMemory	process_identifier: 1320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 268288 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x055a0400	failed	3221225550
1619421077.252374 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a62000	success	0

A process attempted to delay the analysis task. (1 个事件)

description

40464324d8f44be31215b439cd3c9e9b.exe tried to sleep 129 seconds, actually delayed analysis time by 129 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.455652162553343

section

{'size_of_data': '0x000d9c00', 'virtual_address': '0x00002000', 'entropy': 7.455652162553343, 'name': '.text', 'virtual_size': '0x000d9a94'}

description

A section with a high entropy has been found

entropy

0.828340466000951

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421033.158374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619421077.705374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3000 process_handle: 0x00004338	failed
1619421077.705374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3000 process_handle: 0x00004338	success
1619421077.767374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x00005b80	failed
1619421077.767374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x00005b80	success
1619421077.798374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 472 process_handle: 0x0000f1ac	failed
1619421077.798374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 472 process_handle: 0x0000f1ac	success
1619421077.845374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 176 process_handle: 0x0000b5a4	failed
1619421077.845374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 176 process_handle: 0x0000b5a4	success
1619421077.877374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 912 process_handle: 0x0000cdec	failed
1619421077.877374 NtTerminateProcess	status_code: 0xffffffff process_identifier: 912 process_handle: 0x0000cdec	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619421077.580374 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000dd6c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.736374 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000109a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.783374 NtAllocateVirtualMemory	process_identifier: 472 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00008e00 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.814374 NtAllocateVirtualMemory	process_identifier: 176 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00003c24 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.845374 NtAllocateVirtualMemory	process_identifier: 912 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000aa18 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1320 manipulating memory of non-child process 3000
Process injection	Process 1320 manipulating memory of non-child process 2968
Process injection	Process 1320 manipulating memory of non-child process 472
Process injection	Process 1320 manipulating memory of non-child process 176
Process injection	Process 1320 manipulating memory of non-child process 912
1619421077.580374 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000dd6c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619421077.736374 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000109a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619421077.783374 NtAllocateVirtualMemory	process_identifier: 472 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00008e00 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619421077.814374 NtAllocateVirtualMemory	process_identifier: 176 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00003c24 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619421077.845374 NtAllocateVirtualMemory	process_identifier: 912 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000aa18 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1619421031.877374 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1320	success	0
1619421031.892374 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 1320	success	0
1619421031.908374 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 1320	success	0
1619421033.455374 NtResumeThread	thread_handle: 0x00000208 suspend_count: 1 process_identifier: 1320	success	0
1619421033.486374 NtResumeThread	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 1320	success	0
1619421077.377374 NtResumeThread	thread_handle: 0x00002ca0 suspend_count: 1 process_identifier: 1320	success	0
1619421077.377374 NtResumeThread	thread_handle: 0x0000f37c suspend_count: 1 process_identifier: 1320	success	0
1619421077.580374 CreateProcessInternalW	thread_identifier: 2032 thread_handle: 0x00006638 process_identifier: 3000 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000dd6c inherit_handles: 0	success	1
1619421077.580374 NtGetContextThread	thread_handle: 0x00006638	success	0
1619421077.580374 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000dd6c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.736374 CreateProcessInternalW	thread_identifier: 2604 thread_handle: 0x00004338 process_identifier: 2968 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000109a0 inherit_handles: 0	success	1
1619421077.736374 NtGetContextThread	thread_handle: 0x00004338	success	0
1619421077.736374 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000109a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.783374 CreateProcessInternalW	thread_identifier: 2812 thread_handle: 0x00005b80 process_identifier: 472 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00008e00 inherit_handles: 0	success	1
1619421077.783374 NtGetContextThread	thread_handle: 0x00005b80	success	0
1619421077.783374 NtAllocateVirtualMemory	process_identifier: 472 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00008e00 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.814374 CreateProcessInternalW	thread_identifier: 624 thread_handle: 0x0000f1ac process_identifier: 176 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00003c24 inherit_handles: 0	success	1
1619421077.814374 NtGetContextThread	thread_handle: 0x0000f1ac	success	0
1619421077.814374 NtAllocateVirtualMemory	process_identifier: 176 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00003c24 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619421077.845374 CreateProcessInternalW	thread_identifier: 368 thread_handle: 0x0000b5a4 process_identifier: 912 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40464324d8f44be31215b439cd3c9e9b.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000aa18 inherit_handles: 0	success	1
1619421077.845374 NtGetContextThread	thread_handle: 0x0000b5a4	success	0
1619421077.845374 NtAllocateVirtualMemory	process_identifier: 912 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000aa18 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-04 10:32:59

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.