12.0
0-day
50 个模型检测该样本为恶意！
重新分析
更多

c034ae316af0ece9a78efa00344d95e6b76f02f5b75b953d85e2afec9cf18429

43baa88576ea506de7f43432a5e38830.exe

分析耗时

85s

最近分析

文件大小

801.7KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=86 ATTRIBUTE CLOUD CONFIDENCE DANGEROUSSIG ELDORADO FAREIT FBFVZ GDSDA GENCIRC GENERICKD HIGHCONFIDENCE KRYPTIK MALWARE@#2J5HIJMS2MNGP R002C0DG920 RACCOONSTEALER SCORE TSCOPE UNSAFE YQ1@ASO@3TK ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FWJ!43BAA88576EA 20200727 6.0.6.653
Alibaba TrojanSpy:MSIL/AgentTesla.84b6f238 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:DangerousSig [Trj] 20200727 18.4.3895.0
Kingsoft 20200727 2013.8.14.323
Tencent Malware.Win32.Gencirc.11a5f6ce 20200727 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620751313.142125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1620726223.344125
IsDebuggerPresent
failed 0 0
1620726223.344125
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1620751313.923125
WriteConsoleW
buffer: 成功: 成功创建计划任务 "MyApp"。
console_handle: 0x00000007
success 1 0
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620726223.375125
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .sdata
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 70 个事件)
Time & API Arguments Status Return Repeated
1620726222.860125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x004f0000
success 0 0
1620726222.860125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00530000
success 0 0
1620726223.078125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02090000
success 0 0
1620726223.078125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02280000
success 0 0
1620726223.203125
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1620726223.344125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x022c0000
success 0 0
1620726223.344125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x024a0000
success 0 0
1620726223.344125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059a000
success 0 0
1620726223.360125
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1620726223.360125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00592000
success 0 0
1620726223.625125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f2000
success 0 0
1620726223.735125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00915000
success 0 0
1620726223.735125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0091b000
success 0 0
1620726223.735125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00917000
success 0 0
1620726223.860125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f3000
success 0 0
1620726223.891125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008fc000
success 0 0
1620726223.953125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f4000
success 0 0
1620726223.969125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00aa0000
success 0 0
1620726224.250125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f5000
success 0 0
1620726224.360125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00aa1000
success 0 0
1620726224.500125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00aad000
success 0 0
1620726224.672125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00906000
success 0 0
1620726224.672125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0090a000
success 0 0
1620726224.672125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00907000
success 0 0
1620726224.953125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f6000
success 0 0
1620726225.016125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f8000
success 0 0
1620726225.063125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00aae000
success 0 0
1620726225.125125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab0000
success 0 0
1620726225.125125
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73ab9000
success 0 0
1620726225.125125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02210000
success 0 0
1620726225.125125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02211000
success 0 0
1620726225.141125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02216000
success 0 0
1620726225.266125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f9000
success 0 0
1620726258.282125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02217000
success 0 0
1620726258.282125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02218000
success 0 0
1620726258.313125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0221e000
success 0 0
1620726258.375125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023f0000
success 0 0
1620726258.375125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0221f000
success 0 0
1620726258.391125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02420000
success 0 0
1620726258.391125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02421000
success 0 0
1620726258.391125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02422000
success 0 0
1620726258.407125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02423000
success 0 0
1620726258.438125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02424000
success 0 0
1620726258.500125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02428000
success 0 0
1620726258.688125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02281000
success 0 0
1620726258.735125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059c000
success 0 0
1620726258.844125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02429000
success 0 0
1620726258.907125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023f1000
success 0 0
1620726258.907125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0242a000
success 0 0
1620726258.953125
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023f2000
success 0 0
Creates a suspicious process (3 个事件)
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\Administrator.Oskar-PC\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1620751312.407625
ShellExecuteExW
parameters: /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.442542195541985 section {'size_of_data': '0x00083600', 'virtual_address': '0x00002000', 'entropy': 7.442542195541985, 'name': '.text', 'virtual_size': '0x000834e4'} description A section with a high entropy has been found
entropy 0.6614222781623663 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1620726224.594125
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\Administrator.Oskar-PC\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1620726259.297125
NtAllocateVirtualMemory
process_identifier: 2964
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000224
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Installs itself for autorun at Windows startup (3 个事件)
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\Administrator.Oskar-PC\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Potential code injection by writing to the memory of another process (8 个事件)
Time & API Arguments Status Return Repeated
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL|ØÆ^à 8XP@Àf' œ°‘.textô78`P`.data(P<@0À.rdataÈ`>@0@.eh_fram< pB@0@.bssp€€0À.idataœP@0À.CRT X@0À.tls °Z@0À
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: service.exeýÿÿÿ@ðG@ÿÿÿÿ
process_handle: 0x00000224
base_address: 0x00405000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: libgcc_s_dw2-1.dll__register_frame_info__deregister_frame_infolibgcj-16.dll_Jv_RegisterClasses47hVqg4ztcXE8dBe8JP6Q4KGu6FosHMUZNxkqi2EVXuCcfwkhKjrfxvL8E2X5vy4Mb8KihxnMEsoDXP8fV647yeARRhsv5C%APPDATA%\service.exe/C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fcmd.exeopen%APPDATA%%s\%s $@Mingw runtime failure: VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. .glob-1.0-mingw32.GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (MinGW.org GCC-6.3.0-1) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0
process_handle: 0x00000224
base_address: 0x00406000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: zR| ˆàŸÿÿ¥C R K 8t¡ÿÿçA…B DƒTH¢ÿÿ?C@{lp¢ÿÿC €|¢ÿÿC ”ˆ¢ÿÿ¨„¢ÿÿzR| ˆ(h¢ÿÿáA…B E†ƒ ÃAÆAÅ D H,£ÿÿ.A…B jÅ zR| ˆ4$£ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ<T\£ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ<”¤ÿÿAƒHPnHCPJLCP^LCPLLCPYHCPHAÃDÔü¤ÿÿ~A†A ƒC \  CÃAÆK z  HÃAÆA C EÃAÆ(4¥ÿÿeA†A ƒC ^  AÃAÆK <Hx¥ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃTˆ8¦ÿÿŸA‡A †FƒH€ZxC€J|C€k|C€L|C€YxC€HAà AÆAÇ(à€¦ÿÿ`A†A ƒC X  AÃAÆA < ´¦ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ4Lt§ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ4„¬§ÿÿjA†A ƒC i  AÃAÆA q FÃAÆ4¼ä§ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ<ô¨ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ<4ܨÿÿîAƒCP\HCPJLCPFLCPLLCPYHCPHAÃ0tŒ©ÿÿ\A†A ƒF°F¤C°H AÃAÆ(¨ÑÿÿåD GuEutu|uxzR| ˆ<t©ÿÿŸA…B F‡†ƒ- ÃAÆAÇAÅ G É ÃAÆAÇAÅ A zR| ˆ$¼¬ÿÿ]ƒH  …AÅ _ÃzR| ˆŒ­ÿÿ,N\ 4¤­ÿÿFAƒC j AÃA XЭÿÿzR| ˆÄ­ÿÿCC U H `8<ô­ÿÿƒA†A ƒC d  FÃAÆC h  FÃAÆC xH®ÿÿzR| ˆ8,®ÿÿ`A†A ƒC LI PC jC C AÃAÆDXP®ÿÿ‚A†A ƒE L  CÃAÆI sH UC E  AÃAÆA < ˜®ÿÿ›AƒC P CÃI LI gC C CÃK ZC (àø®ÿÿ—C a A iC ] B LC zR| ˆT¯ÿÿJA†A ƒC d<„¯ÿÿðA…A ‡C†AƒG`XTC`i AÃAÆ AÇAÅK dPC`FPC`C AÃAÆ AÇAÅA 4¤ °ÿÿËj‡A †AƒC0ä Aà AÆAÇJ zR| ˆ¼±ÿÿlC A A zR| ˆ4ø±ÿÿ“I†A ƒI ÃAÆA sÃAÆF ƒ†(T`²ÿÿcE†A ƒE H AÃAÆl€¤²ÿÿµA…A ‡C†AƒCPn CÃAÆ AÇAÅC M DÃAÆ AÇAÅA C DÃAÆ AÇAÅA Tðô´ÿÿA…A ‡C†AƒC@  AÃAÆ AÇAÅC K AÃAÆ AÇAÅA DH¼¶ÿÿ\A‡A †CƒE @ Cà AÆAÇA CFà AÆAÇ(Ô¶ÿÿIA†A ƒG o  AÃAÆF ,¼ø¶ÿÿƒA…B C‡†ƒd ÃAÆAÇAÅ C ,ìX¿ÿÿãA…B F‡†ƒF ÃAÆAÇAÅ A @Àÿÿ_A‡A †AƒC O Aà AÆAÇH wAà AÆAÇzR| ˆ<ÀÿÿôA…B F‡†ƒ² ÃCÆAÇAÅ A P ÃAÆAÇAÅ A zR| ˆ@ÄÃÿÿÏA†A ƒHàPØCàL  CÃAÆC I  CÃAÆA L`PÄÿÿ¢A†A ƒHàPØCàG  CÃAÆH M  CÃAÆA [ CÃAÆ@°°Äÿÿ·A…A ‡A†AƒFÀM CÃAÆ AÇAÅC ô,ÆÿÿFAƒCq AÃA (XÆÿÿBAƒC VC Q AÃA ,D|ÆÿÿXAƒC VC R AÃA eAÃt¬Æÿÿ'CQ A 4ÀÆÿÿqA†A ƒC R  AÃAÆG N AÃAÆzR| ˆ¬Êÿÿ A…B AÅ 
process_handle: 0x00000224
base_address: 0x00407000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: x¼–‘àÔ–ø‘ì`—’p‘p—ˆ’x‘—’¨’´’Ì’ä’ò’““,“<“J“\“l“‚“–“¨“¶“Ä“Ô“ð“””6”>”L”^”n”x”„”””¤”´””Ԕޔè”ô”••••(•4•<•F•P•X•b•l•x•‚•Œ•–•¢•¬•¶•À•Ê•Ô•à•ì•ü•– –4–D–¨’´’Ì’ä’ò’““,“<“J“\“l“‚“–“¨“¶“Ä“Ô“ð“””6”>”L”^”n”x”„”””¤”´””Ԕޔè”ô”••••(•4•<•F•P•X•b•l•x•‚•Œ•–•¢•¬•¶•À•Ê•Ô•à•ì•ü•– –4–D–pCopyFileAÏDeleteCriticalSectionìEnterCriticalSectionExitProcessExpandEnvironmentStringsA,FindClose0FindFirstFileAAFindNextFileA`FreeLibrary„GetCommandLineAþGetLastErrorGetModuleFileNameAGetModuleHandleAAGetProcAddress¯GlobalAllocºGlobalLockÁGlobalUnlockÞInitializeCriticalSection.LeaveCriticalSection1LoadLibraryAtSetUnhandledExceptionFilter€Sleep•TlsGetValue½VirtualProtect¿VirtualQueryP_strdupR_stricollX__getmainargsw__mb_cur_maxƒ__p__environ…__p__fmode™__set_app_typeÛ_cexit_errnoD_fpreset^_fullpath¡_iob¦_isctype±_onexitº_pctypeñ_setmode;abortCatexitJcallockfreevfwrite£mallocªmbstowcs¯memcpyÄreallocÆrenameËsetlocaleÍsignalÐsprintfÚstrcollástrlenýtolowervfprintf-wcstombsShellExecuteA=CloseClipboard±EmptyClipboardîGetClipboardDataÇOpenClipboard SetClipboardDataKERNEL32.dllmsvcrt.dll((((((((((((((((((((((((((((((((msvcrt.dll<SHELL32.DLLPPPPPUSER32.dll
process_handle: 0x00000224
base_address: 0x00409000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: $@Ð#@
process_handle: 0x00000224
base_address: 0x0040a000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: °@°@8€@ @
process_handle: 0x00000224
base_address: 0x0040b000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: @
process_handle: 0x00000224
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL|ØÆ^à 8XP@Àf' œ°‘.textô78`P`.data(P<@0À.rdataÈ`>@0@.eh_fram< pB@0@.bssp€€0À.idataœP@0À.CRT X@0À.tls °Z@0À
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2520 called NtSetContextThread to modify thread in remote process 2964
Time & API Arguments Status Return Repeated
1620726259.297125
NtSetContextThread
thread_handle: 0x00000220
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2964
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2520 resumed a thread in remote process 2964
Time & API Arguments Status Return Repeated
1620726259.594125
NtResumeThread
thread_handle: 0x00000220
suspend_count: 1
process_identifier: 2964
success 0 0
Uses Sysinternals tools in order to add additional command line functionality (3 个事件)
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\Administrator.Oskar-PC\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (19 个事件)
Time & API Arguments Status Return Repeated
1620726223.344125
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2520
success 0 0
1620726223.360125
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 2520
success 0 0
1620726223.422125
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 2520
success 0 0
1620726259.297125
CreateProcessInternalW
thread_identifier: 2944
thread_handle: 0x00000220
process_identifier: 2964
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\43baa88576ea506de7f43432a5e38830.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\43baa88576ea506de7f43432a5e38830.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000224
inherit_handles: 0
success 1 0
1620726259.297125
NtGetContextThread
thread_handle: 0x00000220
success 0 0
1620726259.297125
NtAllocateVirtualMemory
process_identifier: 2964
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000224
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL|ØÆ^à 8XP@Àf' œ°‘.textô78`P`.data(P<@0À.rdataÈ`>@0@.eh_fram< pB@0@.bssp€€0À.idataœP@0À.CRT X@0À.tls °Z@0À
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer:
process_handle: 0x00000224
base_address: 0x00401000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: service.exeýÿÿÿ@ðG@ÿÿÿÿ
process_handle: 0x00000224
base_address: 0x00405000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: libgcc_s_dw2-1.dll__register_frame_info__deregister_frame_infolibgcj-16.dll_Jv_RegisterClasses47hVqg4ztcXE8dBe8JP6Q4KGu6FosHMUZNxkqi2EVXuCcfwkhKjrfxvL8E2X5vy4Mb8KihxnMEsoDXP8fV647yeARRhsv5C%APPDATA%\service.exe/C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /fcmd.exeopen%APPDATA%%s\%s $@Mingw runtime failure: VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d. Unknown pseudo relocation bit size %d. .glob-1.0-mingw32.GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (MinGW.org GCC-6.3.0-1) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0GCC: (GNU) 6.3.0
process_handle: 0x00000224
base_address: 0x00406000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: zR| ˆàŸÿÿ¥C R K 8t¡ÿÿçA…B DƒTH¢ÿÿ?C@{lp¢ÿÿC €|¢ÿÿC ”ˆ¢ÿÿ¨„¢ÿÿzR| ˆ(h¢ÿÿáA…B E†ƒ ÃAÆAÅ D H,£ÿÿ.A…B jÅ zR| ˆ4$£ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ<T\£ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ<”¤ÿÿAƒHPnHCPJLCP^LCPLLCPYHCPHAÃDÔü¤ÿÿ~A†A ƒC \  CÃAÆK z  HÃAÆA C EÃAÆ(4¥ÿÿeA†A ƒC ^  AÃAÆK <Hx¥ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃTˆ8¦ÿÿŸA‡A †FƒH€ZxC€J|C€k|C€L|C€YxC€HAà AÆAÇ(à€¦ÿÿ`A†A ƒC X  AÃAÆA < ´¦ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ4Lt§ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ4„¬§ÿÿjA†A ƒC i  AÃAÆA q FÃAÆ4¼ä§ÿÿiA†A ƒC ^  AÃAÆK q FÃAÆ<ô¨ÿÿÿAƒHP^HCPJLCPPLCPLLCPYHCPHAÃ<4ܨÿÿîAƒCP\HCPJLCPFLCPLLCPYHCPHAÃ0tŒ©ÿÿ\A†A ƒF°F¤C°H AÃAÆ(¨ÑÿÿåD GuEutu|uxzR| ˆ<t©ÿÿŸA…B F‡†ƒ- ÃAÆAÇAÅ G É ÃAÆAÇAÅ A zR| ˆ$¼¬ÿÿ]ƒH  …AÅ _ÃzR| ˆŒ­ÿÿ,N\ 4¤­ÿÿFAƒC j AÃA XЭÿÿzR| ˆÄ­ÿÿCC U H `8<ô­ÿÿƒA†A ƒC d  FÃAÆC h  FÃAÆC xH®ÿÿzR| ˆ8,®ÿÿ`A†A ƒC LI PC jC C AÃAÆDXP®ÿÿ‚A†A ƒE L  CÃAÆI sH UC E  AÃAÆA < ˜®ÿÿ›AƒC P CÃI LI gC C CÃK ZC (àø®ÿÿ—C a A iC ] B LC zR| ˆT¯ÿÿJA†A ƒC d<„¯ÿÿðA…A ‡C†AƒG`XTC`i AÃAÆ AÇAÅK dPC`FPC`C AÃAÆ AÇAÅA 4¤ °ÿÿËj‡A †AƒC0ä Aà AÆAÇJ zR| ˆ¼±ÿÿlC A A zR| ˆ4ø±ÿÿ“I†A ƒI ÃAÆA sÃAÆF ƒ†(T`²ÿÿcE†A ƒE H AÃAÆl€¤²ÿÿµA…A ‡C†AƒCPn CÃAÆ AÇAÅC M DÃAÆ AÇAÅA C DÃAÆ AÇAÅA Tðô´ÿÿA…A ‡C†AƒC@  AÃAÆ AÇAÅC K AÃAÆ AÇAÅA DH¼¶ÿÿ\A‡A †CƒE @ Cà AÆAÇA CFà AÆAÇ(Ô¶ÿÿIA†A ƒG o  AÃAÆF ,¼ø¶ÿÿƒA…B C‡†ƒd ÃAÆAÇAÅ C ,ìX¿ÿÿãA…B F‡†ƒF ÃAÆAÇAÅ A @Àÿÿ_A‡A †AƒC O Aà AÆAÇH wAà AÆAÇzR| ˆ<ÀÿÿôA…B F‡†ƒ² ÃCÆAÇAÅ A P ÃAÆAÇAÅ A zR| ˆ@ÄÃÿÿÏA†A ƒHàPØCàL  CÃAÆC I  CÃAÆA L`PÄÿÿ¢A†A ƒHàPØCàG  CÃAÆH M  CÃAÆA [ CÃAÆ@°°Äÿÿ·A…A ‡A†AƒFÀM CÃAÆ AÇAÅC ô,ÆÿÿFAƒCq AÃA (XÆÿÿBAƒC VC Q AÃA ,D|ÆÿÿXAƒC VC R AÃA eAÃt¬Æÿÿ'CQ A 4ÀÆÿÿqA†A ƒC R  AÃAÆG N AÃAÆzR| ˆ¬Êÿÿ A…B AÅ 
process_handle: 0x00000224
base_address: 0x00407000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: x¼–‘àÔ–ø‘ì`—’p‘p—ˆ’x‘—’¨’´’Ì’ä’ò’““,“<“J“\“l“‚“–“¨“¶“Ä“Ô“ð“””6”>”L”^”n”x”„”””¤”´””Ԕޔè”ô”••••(•4•<•F•P•X•b•l•x•‚•Œ•–•¢•¬•¶•À•Ê•Ô•à•ì•ü•– –4–D–¨’´’Ì’ä’ò’““,“<“J“\“l“‚“–“¨“¶“Ä“Ô“ð“””6”>”L”^”n”x”„”””¤”´””Ԕޔè”ô”••••(•4•<•F•P•X•b•l•x•‚•Œ•–•¢•¬•¶•À•Ê•Ô•à•ì•ü•– –4–D–pCopyFileAÏDeleteCriticalSectionìEnterCriticalSectionExitProcessExpandEnvironmentStringsA,FindClose0FindFirstFileAAFindNextFileA`FreeLibrary„GetCommandLineAþGetLastErrorGetModuleFileNameAGetModuleHandleAAGetProcAddress¯GlobalAllocºGlobalLockÁGlobalUnlockÞInitializeCriticalSection.LeaveCriticalSection1LoadLibraryAtSetUnhandledExceptionFilter€Sleep•TlsGetValue½VirtualProtect¿VirtualQueryP_strdupR_stricollX__getmainargsw__mb_cur_maxƒ__p__environ…__p__fmode™__set_app_typeÛ_cexit_errnoD_fpreset^_fullpath¡_iob¦_isctype±_onexitº_pctypeñ_setmode;abortCatexitJcallockfreevfwrite£mallocªmbstowcs¯memcpyÄreallocÆrenameËsetlocaleÍsignalÐsprintfÚstrcollástrlenýtolowervfprintf-wcstombsShellExecuteA=CloseClipboard±EmptyClipboardîGetClipboardDataÇOpenClipboard SetClipboardDataKERNEL32.dllmsvcrt.dll((((((((((((((((((((((((((((((((msvcrt.dll<SHELL32.DLLPPPPPUSER32.dll
process_handle: 0x00000224
base_address: 0x00409000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: $@Ð#@
process_handle: 0x00000224
base_address: 0x0040a000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: °@°@8€@ @
process_handle: 0x00000224
base_address: 0x0040b000
success 1 0
1620726259.297125
WriteProcessMemory
process_identifier: 2964
buffer: @
process_handle: 0x00000224
base_address: 0x7efde008
success 1 0
1620726259.297125
NtSetContextThread
thread_handle: 0x00000220
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199168
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2964
success 0 0
1620726259.594125
NtResumeThread
thread_handle: 0x00000220
suspend_count: 1
process_identifier: 2964
success 0 0
1620751312.392625
CreateProcessInternalW
thread_identifier: 2196
thread_handle: 0x000001e4
process_identifier: 420
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000258
inherit_handles: 0
success 1 0
1620751312.845875
CreateProcessInternalW
thread_identifier: 1752
thread_handle: 0x00000080
process_identifier: 1760
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /tn MyApp /tr C:\Users\Administrator.Oskar-PC\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000084
inherit_handles: 1
success 1 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
MicroWorld-eScan Trojan.GenericKD.34178718
FireEye Trojan.GenericKD.34178718
McAfee Fareit-FWJ!43BAA88576EA
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2162819
Sangfor Malware
K7AntiVirus Trojan ( 0056a4351 )
Alibaba TrojanSpy:MSIL/AgentTesla.84b6f238
K7GW Trojan ( 0056a4351 )
Cybereason malicious.7f1974
Arcabit Trojan.Generic.D209869E
F-Prot W32/Agent.BVW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:DangerousSig [Trj]
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender Trojan.GenericKD.34178718
Paloalto generic.ml
AegisLab Trojan.MSIL.Stealer.l!c
Rising Spyware.Stealer!8.3090 (CLOUD)
Ad-Aware Trojan.GenericKD.34178718
Emsisoft Trojan.GenericKD.34178718 (B)
Comodo Malware@#2j5hijms2mngp
F-Secure Trojan.TR/Kryptik.fbfvz
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DG920
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Inject
Cyren W32/Agent.BVW.gen!Eldorado
Webroot W32.Trojan.Gen
Avira TR/Kryptik.fbfvz
MAX malware (ai score=86)
Antiy-AVL Trojan[Spy]/MSIL.Stealer
Microsoft Trojan:MSIL/AgentTesla.VN!MTB
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
GData Trojan.GenericKD.34178718
Cynet Malicious (score: 85)
BitDefenderTheta Gen:NN.ZemsilF.34138.Yq1@aSo@3Tk
ALYac Trojan.GenericKD.34178718
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.RaccoonStealer
ESET-NOD32 a variant of MSIL/Kryptik.WTF
TrendMicro-HouseCall TROJ_GEN.R002C0DG920
Tencent Malware.Win32.Gencirc.11a5f6ce
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/Kryptik.WTF!tr
AVG Win32:DangerousSig [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Generic/Trojan.Spy.67f
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-07 19:27:17

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 53945 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.