SmartHawk

6.2

高危

46 个模型检测该样本为恶意！

重新分析

下载样本

0c64d937fd851e1d904621f69120ab4c7fe8ba611ac5b21640afeccab0b51aad

487759293ca500a68f1140a291e35b77.exe

分析耗时

91s

最近分析

文件大小

132.1KB

静态报毒动态报毒 5QY5YVS8BLV AI SCORE=89 CONFIDENCE ELDORADO EMOTET GENCIRC GENERICKDZ GENKRYPTIK HCEJ HFQQ HGIASOOA HIGH CONFIDENCE KCLOUD KRYPTIK MALWARE@#178D2WTQLIGIR QUYQR R348891 SCORE UNSAFE UU0CAHOCINW 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_60% (W)	20210203	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20210223	21.1.5827.0
Alibaba	Trojan:Win32/Emotet.f77b6cef	20190527	0.3.0.5
Kingsoft	Win32.Troj.Banker.(kcloud)	20210223	2017.9.26.565
McAfee		20210226	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cdeb65	20210223	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464042.687875 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619464031.968875 CryptGenKey	crypto_handle: 0x0093c288 algorithm_identifier: 0x0000660e () provider_handle: 0x00884c78 flags: 1 key: fÏëKÄ¼FÍ·:ÿK6ìÓ	success	1
1619464044.671875 CryptExportKey	crypto_handle: 0x0093c288 crypto_export_handle: 0x00884d40 buffer: f¤ÒHrø4c$¨~<Ô9É¦V§3OÆ_í þÔ?g1ý»Vu6i2sX¹¦UÉvÆõÝv2ÆS/úÝQK±)\ÆÇdd½V{ÄV´üÆKsßµji9 blob_type: 1 flags: 64	success	1
1619464072.108875 CryptExportKey	crypto_handle: 0x0093c288 crypto_export_handle: 0x00884d40 buffer: f¤o«÷ýª.zþ3È?5qÜÔÏ@õñÌsúÅz?ùÿ;æ¿l)]NÁá½ÐwFÂ¦"É§¿)0ÎG>4¦ ªÂ¹^y¡ªÔûõ= blob_type: 1 flags: 64	success	1
1619464076.577875 CryptExportKey	crypto_handle: 0x0093c288 crypto_export_handle: 0x00884d40 buffer: f¤ÝD%JB¼x«beB\|û]¤õøO/Àâ Í\xÜßw¾L¶ºþÕ¦p®CåÚÜ½ëN£ÍVOwÎ\|£ä¼´ÌÀEÁY ¦¦DCÐt+þíz ýÏ0 Ñ±± blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464030.608875 NtAllocateVirtualMemory	process_identifier: 2860 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005e0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464046.108875 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

487759293ca500a68f1140a291e35b77.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464045.562875 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	209.126.6.222
host	5.153.250.14
host	65.36.62.20

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619464048.733875 RegSetValueExA	key_handle: 0x0000039c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619464048.733875 RegSetValueExA	key_handle: 0x0000039c value: às¯ÙÍ:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619464048.733875 RegSetValueExA	key_handle: 0x0000039c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619464048.733875 RegSetValueExW	key_handle: 0x0000039c value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619464048.733875 RegSetValueExA	key_handle: 0x000003b4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619464048.733875 RegSetValueExA	key_handle: 0x000003b4 value: às¯ÙÍ:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619464048.733875 RegSetValueExA	key_handle: 0x000003b4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619464048.749875 RegSetValueExW	key_handle: 0x00000398 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69602
FireEye	Generic.mg.487759293ca500a6
ALYac	Trojan.Agent.Emotet
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Emotet.PED
CrowdStrike	win/malicious_confidence_60% (W)
BitDefender	Trojan.GenericKDZ.69602
K7GW	Trojan ( 0056cfcb1 )
K7AntiVirus	Trojan ( 0056cfcb1 )
Arcabit	Trojan.Generic.D10FE2
Cyren	W32/Emotet.AQR.gen!Eldorado
Symantec	Packed.Generic.554
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Packed.Generickdz-9481059-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
Alibaba	Trojan:Win32/Emotet.f77b6cef
Rising	Trojan.Kryptik!8.8 (TFE:5:5qY5YVS8bLV)
Ad-Aware	Trojan.GenericKDZ.69602
Emsisoft	Trojan.Emotet (A)
Comodo	Malware@#178d2wtqligir
F-Secure	Trojan.TR/Kryptik.quyqr
Zillya	Trojan.Emotet.Win32.24752
McAfee-GW-Edition	BehavesLike.Win32.Emotet.cm
Ikarus	Trojan-Banker.Emotet
Avira	TR/Kryptik.quyqr
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Banker.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa!s1
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
GData	Trojan.GenericKDZ.69602
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R348891
TACHYON	Backdoor/W32.Emotet.135262
Malwarebytes	Trojan.Agent
ESET-NOD32	a variant of Win32/Kryptik.HFQQ
Tencent	Malware.Win32.Gencirc.10cdeb65
Yandex	Trojan.GenKryptik!uU0caHOCINw
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.93ca50
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.Emotet.HgIASOoA

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)

dead_host	172.217.160.110:443
dead_host	5.153.250.14:8080
dead_host	172.217.24.14:443
dead_host	209.126.6.222:8080
dead_host	142.250.66.110:443
dead_host	192.168.56.101:49178
dead_host	65.36.62.20:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 02:05:41

Imports

Library MSVCP60.dll:

• 0x40c71c ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z

• 0x40c720 ?_Xlen@std@@YAXXZ

• 0x40c724 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

• 0x40c728 ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

• 0x40c72c ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z

• 0x40c730 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

• 0x40c734 ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

• 0x40c738 ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z

• 0x40c73c ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

• 0x40c740 ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z

• 0x40c744 ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

• 0x40c748 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

• 0x40c74c ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

• 0x40c750 ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

• 0x40c754 ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

• 0x40c758 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

• 0x40c75c ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x40c760 ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

• 0x40c764 ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

• 0x40c768 ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z

• 0x40c76c ?_Xran@std@@YAXXZ

• 0x40c770 ??0Init@ios_base@std@@QAE@XZ

• 0x40c774 ??1Init@ios_base@std@@QAE@XZ

• 0x40c778 ??1_Winit@std@@QAE@XZ

• 0x40c77c ??0_Winit@std@@QAE@XZ

Library MSVCRT.dll:

• 0x40c7c0 __CxxFrameHandler

• 0x40c7c4 memmove

• 0x40c7c8 _strnicmp

• 0x40c7cc ??2@YAPAXI@Z

• 0x40c7d0 _wcslwr

• 0x40c7d4 malloc

• 0x40c7d8 free

• 0x40c7dc __dllonexit

• 0x40c7e0 _onexit

• 0x40c7e4 _exit

• 0x40c7e8 _XcptFilter

• 0x40c7ec exit

• 0x40c7f0 _acmdln

• 0x40c7f4 __getmainargs

• 0x40c7f8 _initterm

• 0x40c7fc __setusermatherr

• 0x40c800 _adjust_fdiv

• 0x40c804 __p__commode

• 0x40c808 __p__fmode

• 0x40c80c __set_app_type

• 0x40c810 _except_handler3

• 0x40c814 _setmbcp

• 0x40c818 _controlfp

Library MFC42.DLL:

• 0x40c4d4

• 0x40c4d8

• 0x40c4dc

• 0x40c4e0

• 0x40c4e4

• 0x40c4e8

• 0x40c4ec

• 0x40c4f0

• 0x40c4f4

• 0x40c4f8

• 0x40c4fc

• 0x40c500

• 0x40c504

• 0x40c508

• 0x40c50c

• 0x40c510

• 0x40c514

• 0x40c518

• 0x40c51c

• 0x40c520

• 0x40c524

• 0x40c528

• 0x40c52c

• 0x40c530

• 0x40c534

• 0x40c538

• 0x40c53c

• 0x40c540

• 0x40c544

• 0x40c548

• 0x40c54c

• 0x40c550

• 0x40c554

• 0x40c558

• 0x40c55c

• 0x40c560

• 0x40c564

• 0x40c568

• 0x40c56c

• 0x40c570

• 0x40c574

• 0x40c578

• 0x40c57c

• 0x40c580

• 0x40c584

• 0x40c588

• 0x40c58c

• 0x40c590

• 0x40c594

• 0x40c598

• 0x40c59c

• 0x40c5a0

• 0x40c5a4

• 0x40c5a8

• 0x40c5ac

• 0x40c5b0

• 0x40c5b4

• 0x40c5b8

• 0x40c5bc

• 0x40c5c0

• 0x40c5c4

• 0x40c5c8

• 0x40c5cc

• 0x40c5d0

• 0x40c5d4

• 0x40c5d8

• 0x40c5dc

• 0x40c5e0

• 0x40c5e4

• 0x40c5e8

• 0x40c5ec

• 0x40c5f0

• 0x40c5f4

• 0x40c5f8

• 0x40c5fc

• 0x40c600

• 0x40c604

• 0x40c608

• 0x40c60c

• 0x40c610

• 0x40c614

• 0x40c618

• 0x40c61c

• 0x40c620

• 0x40c624

• 0x40c628

• 0x40c62c

• 0x40c630

• 0x40c634

• 0x40c638

• 0x40c63c

• 0x40c640

• 0x40c644

• 0x40c648

• 0x40c64c

• 0x40c650

• 0x40c654

• 0x40c658

• 0x40c65c

• 0x40c660

• 0x40c664

• 0x40c668

• 0x40c66c

• 0x40c670

• 0x40c674

• 0x40c678

• 0x40c67c

• 0x40c680

• 0x40c684

• 0x40c688

• 0x40c68c

• 0x40c690

• 0x40c694

Library KERNEL32.dll:

• 0x40c49c GetStartupInfoA

• 0x40c4a0 GetModuleHandleA

• 0x40c4a4 ExitProcess

Library USER32.dll:

• 0x40c858 SendMessageA

• 0x40c85c AppendMenuA

• 0x40c860 GetSystemMenu

• 0x40c864 DrawIcon

• 0x40c868 GetClientRect

• 0x40c86c GetSystemMetrics

• 0x40c870 IsIconic

• 0x40c874 GetWindowRect

• 0x40c878 IsRectEmpty

• 0x40c87c InvalidateRect

• 0x40c880 EnableWindow

• 0x40c884 LoadIconA

• 0x40c888 ShowWindow

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 142.250.66.110	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.