SmartHawk

5.8

高危

49 个模型检测该样本为恶意！

重新分析

下载样本

ad8c070c48103dbc11875a052aa0447395f6ddda11e3f9e8aed091f0bb14050d

459f63adf5cd96b5af7c2ef4393253fa.exe

分析耗时

234s

最近分析

文件大小

241.5KB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=86 ALI2000008 ATTRIBUTE AUTO BASIC BUJIHV CONFIDENCE CSHARP ELDORADO FAREIT GDSDA GENKD HIGH CONFIDENCE HIGHCONFIDENCE HNLMGH IGENT KRYPTIK MALWARE@#YZ6DFRJ42ZLH MSILKRYPT NOON PACKEDNET PMW@AA6XCXE R343606 RATX SCORE STATIC AI SUSPICIOUS PE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/csharp.ali2000008	20190527	0.3.0.5
Kingsoft		20201211	2017.9.26.565
McAfee	Fareit-FVK!459F63ADF5CD	20201211	6.0.6.653
Tencent	Win32.Trojan.Inject.Auto	20201211	1.0.0.1
Avast	Win32:RATX-gen [Trj]	20201210	21.1.5827.0

Checks if process is being debugged by a debugger (18 个事件)

Time & API	Arguments	Status	Return	Repeated
1619489795.551124 IsDebuggerPresent		failed	0	0
1619489795.551124 IsDebuggerPresent		failed	0	0
1619489805.270374 IsDebuggerPresent		failed	0	0
1619489805.286374 IsDebuggerPresent		failed	0	0
1619489809.973626 IsDebuggerPresent		failed	0	0
1619489809.973626 IsDebuggerPresent		failed	0	0
1619489813.567751 IsDebuggerPresent		failed	0	0
1619489813.567751 IsDebuggerPresent		failed	0	0
1619489836.035751 IsDebuggerPresent		failed	0	0
1619489836.035751 IsDebuggerPresent		failed	0	0
1619489862.305033 IsDebuggerPresent		failed	0	0
1619489862.305033 IsDebuggerPresent		failed	0	0
1619489892.015357 IsDebuggerPresent		failed	0	0
1619489892.015357 IsDebuggerPresent		failed	0	0
1619489897.304686 IsDebuggerPresent		failed	0	0
1619489897.304686 IsDebuggerPresent		failed	0	0
1619489900.670228 IsDebuggerPresent		failed	0	0
1619489900.670228 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619489795.551124 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 240 个事件)

Time & API	Arguments	Status
1619489794.911124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00670000	success
1619489794.911124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00700000	success
1619489795.458124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00420000	success
1619489795.458124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00470000	success
1619489795.505124 NtProtectVirtualMemory	process_identifier: 1300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619489795.551124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b40000	success
1619489795.551124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c40000	success
1619489795.551124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success
1619489795.551124 NtProtectVirtualMemory	process_identifier: 1300 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619489795.551124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success
1619489795.770124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success
1619489795.833124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00445000	success
1619489795.833124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044b000	success
1619489795.833124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success
1619489795.973124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00423000	success
1619489795.973124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042c000	success
1619489796.020124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00680000	success
1619489796.036124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00436000	success
1619489796.036124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1619489796.036124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success
1619489796.098124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00424000	success
1619489796.317124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00425000	success
1619489796.395124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00681000	success
1619489798.567124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00d20000	success
1619489802.661124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00426000	success
1619489802.661124 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00682000	success
1619489803.348876 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02690000	success
1619489805.176374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00600000	success
1619489805.176374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success
1619489805.208374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00a30000	success
1619489805.208374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b20000	success
1619489805.208374 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619489805.270374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b60000	success
1619489805.270374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c50000	success
1619489805.286374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success
1619489805.286374 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619489805.286374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1619489805.301374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00472000	success
1619489805.301374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a5000	success
1619489805.301374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ab000	success
1619489805.301374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a7000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00473000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047c000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00486000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048a000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success
1619489805.333374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00474000	success
1619489805.364374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success
1619489805.364374 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a91000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.547097718939459

section

{'size_of_data': '0x0003c000', 'virtual_address': '0x00002000', 'entropy': 7.547097718939459, 'name': '.text', 'virtual_size': '0x0003bee4'}

description

A section with a high entropy has been found

entropy

0.995850622406639

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 个事件)

Time & API	Arguments	Status	Return
1619489802.270124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489807.395374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489812.067626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489815.630751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489859.223751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489864.477033 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489896.062357 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619489899.539686 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Terminates another process (14 个事件)

Time & API	Arguments	Status
1619489807.489374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000274	failed
1619489807.489374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000274	success
1619489812.176626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	failed
1619489812.176626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	success
1619489815.848751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	failed
1619489815.848751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	success
1619489859.317751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	failed
1619489859.317751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	success
1619489878.008033 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000274	failed
1619489878.008033 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000274	success
1619489896.124357 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	failed
1619489896.124357 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	success
1619489899.648686 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	failed
1619489899.648686 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	success

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.40.66
host	203.208.41.97

Manipulates memory of a non-child process indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3984 manipulating memory of non-child process 4064
Process injection	Process 3984 manipulating memory of non-child process 3092
1619489899.383686 NtAllocateVirtualMemory	process_identifier: 4064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000220 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619489899.383686 NtAllocateVirtualMemory	process_identifier: 4064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000220 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000f0000	success	0	0
1619489899.508686 NtAllocateVirtualMemory	process_identifier: 3092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000234 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619489899.508686 NtAllocateVirtualMemory	process_identifier: 3092 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000234 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.3.Gen
FireEye	Generic.mg.459f63adf5cd96b5
ALYac	Trojan.MSIL.Basic.3.Gen
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056081c1 )
BitDefender	Trojan.MSIL.Basic.3.Gen
K7GW	Trojan ( 0056081c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Kryptik.BAO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Alibaba	Trojan:Win32/csharp.ali2000008
NANO-Antivirus	Trojan.Win32.Noon.hnlmgh
AegisLab	Trojan.MSIL.Noon.l!c
Ad-Aware	Trojan.MSIL.Basic.3.Gen
Sophos	Mal/Generic-S
Comodo	Malware@#yz6dfrj42zlh
F-Secure	Trojan.TR/Crypt.XDR.Gen
DrWeb	Trojan.PackedNET.371
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Trojan.MSIL.Basic.3.Gen (B)
SentinelOne	Static AI - Suspicious PE
GData	Trojan.MSIL.Basic.3.Gen
Webroot	W32.Trojan.GenKD
Avira	TR/Crypt.XDR.Gen
MAX	malware (ai score=86)
Antiy-AVL	Trojan[Spy]/MSIL.Noon
Arcabit	Trojan.MSIL.Basic.3.Gen
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MSILKrypt.R343606
Acronis	suspicious
McAfee	Fareit-FVK!459F63ADF5CD
Malwarebytes	Trojan.Downloader
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Kryptik.WOX
Tencent	Win32.Trojan.Inject.Auto
Yandex	Trojan.Igent.bUjihV.4
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.WOX!tr
BitDefenderTheta	Gen:NN.ZemsilF.34670.pmW@aa6Xcxe
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.b14ace
Avast	Win32:RATX-gen [Trj]
Qihoo-360	Generic/Trojan.Spy.beb

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-07 17:06:32

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.24.14
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
203.208.41.97	80	192.168.56.101	49199

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.