SmartHawk

13.2

0-day

该样本未表现出任何异常！

重新分析

下载样本

60532c23eaeadf51fc21c1ef29ceb5c15d1022d355e3327ca3321b7921a20535

41ec65eaab4ecf4dc45d643158eadba0.exe

分析耗时

91s

最近分析

文件大小

850.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (9 个事件)

Time & API	Arguments	Status	Return
1619421552.02475 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.49275 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.50875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.68075 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.68075 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.68075 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.97775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421552.97775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619421562.602125 GetComputerNameA	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (5 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421497.383125 IsDebuggerPresent		failed	0	0
1619421497.383125 IsDebuggerPresent		failed	0	0
1619421542.867125 IsDebuggerPresent		failed	0	0
1619421543.19575 IsDebuggerPresent		failed	0	0
1619421543.19575 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421497.399125 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 个事件)

Time & API	Arguments	Status	Return
1619421544.16475 bind	ip_address: 127.0.0.1 socket: 596 port: 0	success	0
1619421544.16475 listen	socket: 596 backlog: 2147483647	success	0
1619421544.18075 accept	ip_address: 127.0.0.1 socket: 596 port: 0	failed	4294967295

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://whatismyipaddress.com/

Performs some HTTP requests (1 个事件)

request

GET http://whatismyipaddress.com/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 181 个事件)

Time & API	Arguments	Status	Return
1619421496.524125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00900000	success	0
1619421496.524125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a20000	success	0
1619421497.242125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00d80000	success	0
1619421497.242125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00eb0000	success	0
1619421497.274125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619421497.383125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x023e0000	success	0
1619421497.383125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02550000	success	0
1619421497.383125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success	0
1619421497.383125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619421497.383125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success	0
1619421498.164125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success	0
1619421498.289125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d5000	success	0
1619421498.289125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003db000	success	0
1619421498.289125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d7000	success	0
1619421498.430125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b3000	success	0
1619421498.461125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003bc000	success	0
1619421499.024125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b4000	success	0
1619421499.024125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619421499.164125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00540000	success	0
1619421499.320125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success	0
1619421499.320125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619421499.555125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00541000	success	0
1619421499.711125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c6000	success	0
1619421499.930125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619421500.508125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619421500.508125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b8000	success	0
1619421500.649125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b9000	success	0
1619421500.664125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00542000	success	0
1619421500.680125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success	0
1619421500.711125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c1000	success	0
1619421500.742125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00543000	success	0
1619421500.758125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00546000	success	0
1619421538.758125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00eb1000	success	0
1619421539.055125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success	0
1619421539.195125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c2000	success	0
1619421539.227125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success	0
1619421539.383125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00548000	success	0
1619421539.383125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 541696 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06330400	failed	3221225550
1619421542.539125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003bd000	success	0
1619421542.539125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c3000	success	0
1619421542.539125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00549000	success	0
1619421542.555125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success	0
1619421542.555125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054b000	success	0
1619421542.586125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054c000	success	0
1619421542.742125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054d000	success	0
1619421542.742125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04fe0000	success	0
1619421542.742125 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04fe1000	success	0
1619421542.758125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06330178	failed	3221225550
1619421542.758125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x063301a0	failed	3221225550
1619421542.758125 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x063301c8	failed	3221225550

Looks up the external IP address (1 个事件)

domain

whatismyipaddress.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421547.13375 GetAdaptersAddresses	flags: 1158 family: 0	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.655704276670598

section

{'size_of_data': '0x000d4000', 'virtual_address': '0x00002000', 'entropy': 7.655704276670598, 'name': '.text', 'virtual_size': '0x000d3f1c'}

description

A section with a high entropy has been found

entropy

0.9976470588235294

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421539.367125 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421542.945125 NtAllocateVirtualMemory	process_identifier: 2412 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000777c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0
1619421556.52475 NtAllocateVirtualMemory	process_identifier: 3028 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000640 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

41ec65eaab4ecf4dc45d643158eadba0.exe tried to sleep 2728216 seconds, actually delayed analysis time by 2728216 seconds

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\holdermail.txt

Harvests information related to installed instant messenger clients (1 个事件)

registry

HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnz_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x0000777c base_address: 0x00400000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: ð; process_handle: 0x0000777c base_address: 0x00486000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: @ process_handle: 0x0000777c base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnz_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x0000777c base_address: 0x00400000	success	1	0

Harvests credentials from local email clients (6 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Identities\{586FBF3B-F35E-46E2-9DB8-9E15DC75E9A1}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry	HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2504 called NtSetContextThread to modify thread in remote process 2412
Process injection	Process 2412 called NtSetContextThread to modify thread in remote process 3028
1619421542.945125 NtSetContextThread	thread_handle: 0x000095c8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2412	success	0	0
1619421556.52475 NtSetContextThread	thread_handle: 0x00000628 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4265556 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3028	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2504 resumed a thread in remote process 2412
Process injection	Process 2412 resumed a thread in remote process 3028
1619421543.039125 NtResumeThread	thread_handle: 0x000095c8 suspend_count: 1 process_identifier: 2412	success	0	0
1619421556.88375 NtResumeThread	thread_handle: 0x00000628 suspend_count: 1 process_identifier: 3028	success	0	0

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 个事件)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

Executed a process and injected code into it, probably while unpacking (39 个事件)

Time & API	Arguments	Status	Return
1619421497.383125 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2504	success	0
1619421497.399125 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2504	success	0
1619421497.399125 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2504	success	0
1619421542.852125 NtResumeThread	thread_handle: 0x00009c7c suspend_count: 1 process_identifier: 2504	success	0
1619421542.867125 NtResumeThread	thread_handle: 0x000115dc suspend_count: 1 process_identifier: 2504	success	0
1619421542.945125 CreateProcessInternalW	thread_identifier: 2840 thread_handle: 0x000095c8 process_identifier: 2412 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\41ec65eaab4ecf4dc45d643158eadba0.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\41ec65eaab4ecf4dc45d643158eadba0.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000777c inherit_handles: 0	success	1
1619421542.945125 NtGetContextThread	thread_handle: 0x000095c8	success	0
1619421542.945125 NtAllocateVirtualMemory	process_identifier: 2412 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000777c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELnz_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x0000777c base_address: 0x00400000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: process_handle: 0x0000777c base_address: 0x00402000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: process_handle: 0x0000777c base_address: 0x00482000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: ð; process_handle: 0x0000777c base_address: 0x00486000	success	1
1619421542.945125 WriteProcessMemory	process_identifier: 2412 buffer: @ process_handle: 0x0000777c base_address: 0x7efde008	success	1
1619421542.945125 NtSetContextThread	thread_handle: 0x000095c8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2412	success	0
1619421543.039125 NtResumeThread	thread_handle: 0x000095c8 suspend_count: 1 process_identifier: 2412	success	0
1619421543.19575 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2412	success	0
1619421543.19575 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2412	success	0
1619421543.21175 NtResumeThread	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2412	success	0
1619421544.21175 NtResumeThread	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 2412	success	0
1619421548.41475 NtResumeThread	thread_handle: 0x00000440 suspend_count: 1 process_identifier: 2412	success	0
1619421552.10275 NtResumeThread	thread_handle: 0x000004b0 suspend_count: 1 process_identifier: 2412	success	0
1619421552.35275 NtResumeThread	thread_handle: 0x000004fc suspend_count: 1 process_identifier: 2412	success	0
1619421552.68075 NtResumeThread	thread_handle: 0x0000055c suspend_count: 1 process_identifier: 2412	success	0
1619421552.69575 NtResumeThread	thread_handle: 0x00000578 suspend_count: 1 process_identifier: 2412	success	0
1619421552.69575 NtResumeThread	thread_handle: 0x0000058c suspend_count: 1 process_identifier: 2412	success	0
1619421552.69575 NtResumeThread	thread_handle: 0x000005a0 suspend_count: 1 process_identifier: 2412	success	0
1619421552.96175 NtResumeThread	thread_handle: 0x000005b0 suspend_count: 1 process_identifier: 2412	success	0
1619421552.96175 NtResumeThread	thread_handle: 0x000005cc suspend_count: 1 process_identifier: 2412	success	0
1619421552.97775 NtResumeThread	thread_handle: 0x000005e4 suspend_count: 1 process_identifier: 2412	success	0
1619421552.97775 NtResumeThread	thread_handle: 0x00000608 suspend_count: 1 process_identifier: 2412	success	0
1619421552.97775 NtResumeThread	thread_handle: 0x0000061c suspend_count: 1 process_identifier: 2412	success	0
1619421555.96175 NtResumeThread	thread_handle: 0x00000620 suspend_count: 1 process_identifier: 2412	success	0
1619421556.52475 CreateProcessInternalW	thread_identifier: 2452 thread_handle: 0x00000628 process_identifier: 3028 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\holdermail.txt" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000640 inherit_handles: 0	success	1
1619421556.52475 NtUnmapViewOfSection	process_identifier: 3028 region_size: 4096 process_handle: 0x00000640 base_address: 0x00400000	success	0
1619421556.52475 NtAllocateVirtualMemory	process_identifier: 3028 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000640 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619421556.52475 NtGetContextThread	thread_handle: 0x00000628	success	0
1619421556.52475 NtSetContextThread	thread_handle: 0x00000628 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4265556 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3028	success	0
1619421556.88375 NtResumeThread	thread_handle: 0x00000628 suspend_count: 1 process_identifier: 3028	success	0
1619421562.570125 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 3028	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2060-12-18 17:26:16

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
whatismyipaddress.com	A 104.16.154.36 A 104.16.155.36	104.16.155.36
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.160.78	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49185	104.16.154.36 whatismyipaddress.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://whatismyipaddress.com/	GET / HTTP/1.1 Host: whatismyipaddress.com Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.