SmartHawk

8.6

极危

58 个模型检测该样本为恶意！

重新分析

下载样本

017057a54fad0a90b1e0277ee732762fbd5a995016062e1b84c9f164ae52a189

48edf744128d5dff1212d0fc4c08a2a9.exe

分析耗时

113s

最近分析

文件大小

318.0KB

静态报毒动态报毒 100% 7WWOTXQIO AI SCORE=100 BSCOPE CLOUD CONFIDENCE ELDORADO EMOTET GENCIRC GENERICKDZ GENETIC HGIASOYA HIGH CONFIDENCE HUBWPC KRYPTIK MALWARE@#109NCA2E9XR7A R + TROJ R350263 SCORE SUSGEN SYZPU THJOEBO TUW@AI0VKQAO UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRI!48EDF744128D	20210219	6.0.6.653
Alibaba	Trojan:Win32/Emotet.1fb23208	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20210219	21.1.5827.0
Tencent	Malware.Win32.Gencirc.10cdfd74	20210219	1.0.0.1
Kingsoft		20210219	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619515270.98675 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (7 个事件)

Time & API	Arguments	Status	Return
1619515257.34675 CryptGenKey	crypto_handle: 0x00b72860 algorithm_identifier: 0x0000660e () provider_handle: 0x008a5f30 flags: 1 key: fADYXVØ&NE \K[Ub/	success	1
1619515270.98675 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤½!WwÈFz[Ñl(ìÃïÊFÀ×lz¯K<Æê!ºþÄFÅXxêJR°ôÎ6Z²Ñìë§E2«gµ'<Ñ,(V¨Þ*gV7 ÃOTÐ×÷q²Õ_ blob_type: 1 flags: 64	success	1
1619515298.17475 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤~ºð-¶G/ guÞEÏÊ²NL+P¡k=®Ü¦Âº¤%°'2`ÏâÎ[Mþ>ó*#½Àn8Þ?Ãw@ÄÁo;Pr¹ÅÿúÞå÷Æ8 9MAÁû``ïH? blob_type: 1 flags: 64	success	1
1619515304.11175 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤E×[AGõ-$ÛÎpl ö`h)¨°\{M ÔÒi_¥º¾z{éTÁgRô¿ËoO©Eµ £î»ÌB+üý\¦aµªÝFzpOP´«% blob_type: 1 flags: 64	success	1
1619515309.67475 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤»ª-1sâÔà¦\|àPvg$ÖeÊÑíW ¸È¯¼O¢rZ¬+ÃÁïK ÊöFOzdp7¤ÎjÏBAgíSwNá\|Sá)N XëpRo]ÈãC; blob_type: 1 flags: 64	success	1
1619515314.98675 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤25y¿h(A¢ïEÇP~´ï§uÒýÙEÏò[Ý7:N1ò81héê)ÒéX_ãoÐÕþû=(µL$¹éµâ¡ìr·HdÎ§å¬/_>H*Jú blob_type: 1 flags: 64	success	1
1619515319.43975 CryptExportKey	crypto_handle: 0x00b72860 crypto_export_handle: 0x008a5d20 buffer: f¤é,ø³®·0Kfif~æp+!«§á!ØE?¤d\|$ÆSÐ4xõ³èÐ"¹¹["»feJße_×w¡õxA¤¶*A¢4dÙå9ß¥iòÝ4 blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619515247.439501 NtAllocateVirtualMemory	process_identifier: 624 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004e0000	success
1619514878.880646 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004120000	success
1619515257.00275 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00280000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619515249.346501 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\48edf744128d5dff1212d0fc4c08a2a9.exe newfilepath: C:\Windows\SysWOW64\mciavi32\WebClnt.exe newfilepath_r: C:\Windows\SysWOW64\mciavi32\WebClnt.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\48edf744128d5dff1212d0fc4c08a2a9.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619515271.43975 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

webclnt.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619515271.14275 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (7 个事件)

host	172.217.24.14
host	45.16.226.117
host	50.121.220.50
host	51.75.33.122
host	54.37.42.48
host	68.69.155.181
host	91.121.54.71

Installs itself for autorun at Windows startup (1 个事件)

service_name

WebClnt

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\mciavi32\WebClnt.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619515253.814501 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x00c0c8b8 display_name: WebClnt error_control: 0 service_name: WebClnt filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\mciavi32\WebClnt.exe" filepath_r: "C:\Windows\SysWOW64\mciavi32\WebClnt.exe" service_manager_handle: 0x00c194f0 desired_access: 2 service_type: 16 password:	success	12634296	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619515274.00275 RegSetValueExA	key_handle: 0x00000384 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619515274.00275 RegSetValueExA	key_handle: 0x00000384 value: 0}ª£T;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619515274.00275 RegSetValueExA	key_handle: 0x00000384 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619515274.00275 RegSetValueExW	key_handle: 0x00000384 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619515274.01775 RegSetValueExA	key_handle: 0x0000039c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619515274.01775 RegSetValueExA	key_handle: 0x0000039c value: 0}ª£T;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619515274.01775 RegSetValueExA	key_handle: 0x0000039c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619515274.03375 RegSetValueExW	key_handle: 0x00000380 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\mciavi32\WebClnt.exe:Zone.Identifier

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69887
FireEye	Trojan.GenericKDZ.69887
McAfee	Emotet-FRI!48EDF744128D
Cylance	Unsafe
Zillya	Trojan.Emotet.Win32.28372
Sangfor	Trojan.Win32.Emotet.ARJ
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Emotet.1fb23208
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.4128d5
Arcabit	Trojan.Generic.D110FF
Cyren	W32/Emotet.ARX.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Emotet-9752123-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.vho
BitDefender	Trojan.GenericKDZ.69887
NANO-Antivirus	Trojan.Win32.Emotet.hubwpc
Paloalto	generic.ml
Tencent	Malware.Win32.Gencirc.10cdfd74
Ad-Aware	Trojan.GenericKDZ.69887
TACHYON	Banker/W32.Emotet.325632.B
Sophos	Mal/Generic-R + Troj/Emotet-CMX
Comodo	Malware@#109nca2e9xr7a
F-Secure	Trojan.TR/Emotet.syzpu
DrWeb	Trojan.Emotet.1013
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.THJOEBO
McAfee-GW-Edition	Emotet-FRI!48EDF744128D
Emsisoft	Trojan.Emotet (A)
Jiangmin	Trojan.Banker.Emotet.ohc
eGambit	Generic.Malware
Avira	TR/Emotet.syzpu
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Gridinsoft	Trojan.Win32.Emotet.oa
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.vho
GData	Trojan.GenericKDZ.69887
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R350263
BitDefenderTheta	Gen:NN.ZexaF.34574.tuW@ai0VkqaO
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=100)
VBA32	BScope.Backdoor.Emotet
Malwarebytes	Trojan.MalPack.TRE
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THJOEBO
Rising	Trojan.Kryptik!1.CBC2 (CLOUD)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (12 个事件)

dead_host	192.168.56.101:49181
dead_host	68.69.155.181:80
dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	91.121.54.71:8080
dead_host	50.121.220.50:80
dead_host	51.75.33.122:80
dead_host	45.16.226.117:443
dead_host	192.168.56.101:49184
dead_host	192.168.56.101:49185
dead_host	192.168.56.101:49183
dead_host	54.37.42.48:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-03 03:44:20

Imports

Library KERNEL32.dll:

• 0x403020 UnhandledExceptionFilter

• 0x403024 GetCurrentProcess

• 0x403028 TerminateProcess

• 0x40302c SetUnhandledExceptionFilter

• 0x403030 InterlockedCompareExchange

• 0x403034 Sleep

• 0x403038 InterlockedExchange

• 0x40303c GetSystemTimeAsFileTime

• 0x403040 IsDebuggerPresent

• 0x403044 QueryPerformanceCounter

• 0x403048 GetTickCount

• 0x40304c GetCurrentThreadId

• 0x403050 GetCurrentProcessId

• 0x403054 GetStartupInfoA

• 0x403058 LoadLibraryExA

Library USER32.dll:

• 0x403120 GetClientRect

• 0x403124 PostQuitMessage

• 0x403128 DispatchMessageA

• 0x40312c TranslateMessage

• 0x403130 GetMessageA

• 0x403134 UpdateWindow

• 0x403138 CreateWindowExA

• 0x40313c RegisterClassA

• 0x403140 LoadCursorA

• 0x403144 BeginPaint

• 0x403148 GetSysColor

• 0x40314c EndPaint

• 0x403150 DefWindowProcA

• 0x403154 SendMessageA

• 0x403158 DialogBoxParamA

• 0x40315c SetTimer

• 0x403160 EndDialog

• 0x403164 KillTimer

• 0x403168 MessageBoxA

• 0x40316c SetWindowTextA

• 0x403170 ShowWindow

• 0x403174 InvalidateRect

• 0x403178 LoadIconA

Library GDI32.dll:

• 0x403000 CreateSolidBrush

• 0x403004 CreatePen

• 0x403008 LineTo

• 0x40300c MoveToEx

• 0x403010 GetStockObject

• 0x403014 SelectObject

• 0x403018 Rectangle

Library MSVCP90.dll:

• 0x403060 ?_Unlock@_Mutex@std@@QAEXXZ

• 0x403064 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x403068 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x40306c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x403070 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x403074 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z

• 0x403078 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x40307c ?uncaught_exception@std@@YA_NXZ

• 0x403080 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x403084 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x403088 ?_Lock@_Mutex@std@@QAEXXZ

Library MSVCR90.dll:

• 0x403090 ?terminate@@YAXXZ

• 0x403094 _unlock

• 0x403098 __dllonexit

• 0x40309c _lock

• 0x4030a0 _onexit

• 0x4030a4 _decode_pointer

• 0x4030a8 _except_handler4_common

• 0x4030ac _invoke_watson

• 0x4030b0 _controlfp_s

• 0x4030b4 exit

• 0x4030b8 rand

• 0x4030bc _time64

• 0x4030c0 _crt_debugger_hook

• 0x4030c4 sprintf

• 0x4030c8 __CxxFrameHandler3

• 0x4030cc _wtoi

• 0x4030d0 srand

• 0x4030d4 memcpy

• 0x4030d8 _amsg_exit

• 0x4030dc __getmainargs

• 0x4030e0 _cexit

• 0x4030e4 _exit

• 0x4030e8 _XcptFilter

• 0x4030ec _ismbblead

• 0x4030f0 _wcslwr

• 0x4030f4 _acmdln

• 0x4030f8 _initterm

• 0x4030fc _initterm_e

• 0x403100 _configthreadlocale

• 0x403104 __setusermatherr

• 0x403108 _adjust_fdiv

• 0x40310c __p__commode

• 0x403110 __p__fmode

• 0x403114 _encode_pointer

• 0x403118 __set_app_type

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.98	203.208.40.98
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49190	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.