SmartHawk

7.0

高危

50 个模型检测该样本为恶意！

重新分析

下载样本

7399fc107327a8ecb09632fd6380f18e3f7c382675b9be0a2613beb831337096

4220819b2e52d9ecd3048f4883c4f7c5.exe

分析耗时

42s

最近分析

文件大小

567.5KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=82 ATTRIBUTE AUTO CLOUD CONFIDENCE ELDORADO GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE JM0@A0SVLAH KRYPTIK MALICIOUS MALWARE@#25KQVE9FHDIWW NANOCORE R011C0WF420 R339425 SCORE SIGGEN2 SPUHZ TROJANPSW TROJANX XCYLDD1FDS8 ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic.dx	20200618	6.0.6.653
Alibaba	TrojanPSW:MSIL/Nanocore.d7143259	20190527	0.3.0.5
Avast	Win32:TrojanX-gen [Trj]	20200618	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200619	2013.8.14.323
Tencent	Win32.Trojan.Inject.Auto	20200619	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384593.484375 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384594.094375 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 51 个事件)

Time & API	Arguments	Status
1619384592.703375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00350000	success
1619384592.703375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619384593.422375 NtProtectVirtualMemory	process_identifier: 2996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619384593.484375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success
1619384593.484375 NtProtectVirtualMemory	process_identifier: 2996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619384593.484375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success
1619384593.750375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b2000	success
1619384593.812375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b3000	success
1619384593.828375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004eb000	success
1619384593.828375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e7000	success
1619384593.953375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bc000	success
1619384594.015375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e0000	success
1619384594.062375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e1000	success
1619384594.078375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e2000	success
1619384594.078375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e3000	success
1619384594.109375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e4000	success
1619384594.390375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b4000	success
1619384594.594375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success
1619384594.609375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success
1619384594.640375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619384594.734375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ca000	success
1619384594.734375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success
1619384594.750375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004da000	success
1619384594.765375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ab000	success
1619384594.844375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e5000	success
1619384594.844375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e8000	success
1619384595.140375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ba000	success
1619384595.140375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e9000	success
1619384595.297375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x044c0000	success
1619384595.359375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00361000	success
1619384595.375375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c6000	success
1619384595.469375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x044c1000	success
1619384595.640375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d2000	success
1619384595.750375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e5000	success
1619384596.453375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ea000	success
1619384598.062375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b8000	success
1619384598.812375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x050e0000	success
1619384598.812375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05120000	success
1619384598.812375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05121000	success
1619384598.922375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05122000	success
1619384598.969375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05123000	success
1619384598.969375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05124000	success
1619384598.969375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05126000	success
1619384599.062375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b9000	success
1619384599.234375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005eb000	success
1619384599.281375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05129000	success
1619384599.281375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0512d000	success
1619384599.390375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ec000	success
1619384599.390375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0513e000	success
1619384599.750375 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ed000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.6691178086812855

section

{'size_of_data': '0x0008d400', 'virtual_address': '0x00002000', 'entropy': 7.6691178086812855, 'name': '.text', 'virtual_size': '0x0008d384'}

description

A section with a high entropy has been found

entropy

0.9964726631393298

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384600.015375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619384600.234375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2288 process_handle: 0x0000028c	failed
1619384600.234375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2288 process_handle: 0x0000028c	success
1619384600.281375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x000002a4	failed
1619384600.281375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x000002a4	success
1619384600.344375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 708 process_handle: 0x000002ac	failed
1619384600.344375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 708 process_handle: 0x000002ac	success
1619384600.390375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1760 process_handle: 0x000002b4	failed
1619384600.390375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1760 process_handle: 0x000002b4	success
1619384600.437375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2960 process_handle: 0x000002bc	failed
1619384600.437375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2960 process_handle: 0x000002bc	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619384599.828375 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.234375 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000029c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.281375 NtAllocateVirtualMemory	process_identifier: 708 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.375375 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.406375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 manipulating memory of non-child process 2288
Process injection	Process 2996 manipulating memory of non-child process 2144
Process injection	Process 2996 manipulating memory of non-child process 708
Process injection	Process 2996 manipulating memory of non-child process 1760
Process injection	Process 2996 manipulating memory of non-child process 2960
1619384599.828375 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619384600.234375 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000029c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619384600.281375 NtAllocateVirtualMemory	process_identifier: 708 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619384600.375375 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619384600.406375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (17 个事件)

Time & API	Arguments	Status	Return
1619384593.484375 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2996	success	0
1619384593.547375 NtResumeThread	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 2996	success	0
1619384599.828375 CreateProcessInternalW	thread_identifier: 200 thread_handle: 0x00000284 process_identifier: 2288 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000288 inherit_handles: 0	success	1
1619384599.828375 NtGetContextThread	thread_handle: 0x00000284	success	0
1619384599.828375 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.234375 CreateProcessInternalW	thread_identifier: 2976 thread_handle: 0x0000028c process_identifier: 2144 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000029c inherit_handles: 0	success	1
1619384600.234375 NtGetContextThread	thread_handle: 0x0000028c	success	0
1619384600.234375 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000029c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.281375 CreateProcessInternalW	thread_identifier: 1752 thread_handle: 0x000002a4 process_identifier: 708 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000002a0 inherit_handles: 0	success	1
1619384600.281375 NtGetContextThread	thread_handle: 0x000002a4	success	0
1619384600.281375 NtAllocateVirtualMemory	process_identifier: 708 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.375375 CreateProcessInternalW	thread_identifier: 2040 thread_handle: 0x000002ac process_identifier: 1760 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000002a8 inherit_handles: 0	success	1
1619384600.375375 NtGetContextThread	thread_handle: 0x000002ac	success	0
1619384600.375375 NtAllocateVirtualMemory	process_identifier: 1760 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619384600.406375 CreateProcessInternalW	thread_identifier: 2940 thread_handle: 0x000002b4 process_identifier: 2960 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4220819b2e52d9ecd3048f4883c4f7c5.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000002b0 inherit_handles: 0	success	1
1619384600.406375 NtGetContextThread	thread_handle: 0x000002b4	success	0
1619384600.406375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000002b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

DrWeb	Trojan.PWS.Siggen2.49826
MicroWorld-eScan	Trojan.GenericKD.33960926
McAfee	RDN/Generic.dx
Zillya	Trojan.Kryptik.Win32.2039682
Sangfor	Malware
K7AntiVirus	Trojan ( 00567f921 )
Alibaba	TrojanPSW:MSIL/Nanocore.d7143259
K7GW	Trojan ( 00567f921 )
Arcabit	Trojan.Generic.D20633DE
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZemsilF.34128.Jm0@a0sVLAh
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.WDZ
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.33960926
Paloalto	generic.ml
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Trojan.GenericKD.33960926
Sophos	Mal/Generic-S
Comodo	Malware@#25kqve9fhdiww
F-Secure	Trojan.TR/AD.AgentTesla.spuhz
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R011C0WF420
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
FireEye	Generic.mg.4220819b2e52d9ec
Emsisoft	Trojan.GenericKD.33960926 (B)
Cyren	W32/MSIL_Troj.VP.gen!Eldorado
Webroot	W32.Trojan.Gen
Avira	TR/AD.AgentTesla.spuhz
Microsoft	Trojan:MSIL/Nanocore.PB!MTB
Endgame	malicious (high confidence)
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.33960926
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Kryptik.R339425
ALYac	Trojan.GenericKD.33960926
MAX	malware (ai score=82)
Malwarebytes	Spyware.AgentTesla
TrendMicro-HouseCall	TROJ_GEN.R011C0WF420
Tencent	Win32.Trojan.Inject.Auto
Yandex	Trojan.Kryptik!xCYLDD1Fds8
Ikarus	Trojan-Rat.NanoCore
Fortinet	MSIL/Kryptik.WDZ!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Generic/Trojan.PSW.374

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-03 18:49:47

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.