SmartHawk

7.8

高危

56 个模型检测该样本为恶意！

重新分析

下载样本

a42a0b4af3d8b614fd72685b2499ad686c32a881bf988ee111e0a3b2b19ebcd5

4927f738b3a5003b73fd6654f1dc4bdc.exe

分析耗时

645s

最近分析

文件大小

2.0MB

静态报毒动态报毒 @N0@ASU81RHJ AI SCORE=89 BANKERX CLOUD CONFIDENCE DRIDEX ENCPK FKVOV GENCIRC GENETIC HIGH CONFIDENCE HKABSX INJECT3 KRYPTIK MALICIOUS PE MALWARE@#GEU30XMRFGIJ PINKSBOT QAKBOT QBOT QBOTPMF QVM20 R335605 RAZY S13245366 SCORE SUSGEN TROJANBANKER UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanBanker:Win32/BankerX.dec05a53	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:BankerX-gen [Trj]	20200718	18.4.3895.0
Kingsoft		20200718	2013.8.14.323
McAfee	W32/PinkSbot-GN!4927F738B3A5	20200718	6.0.6.653
Tencent	Malware.Win32.Gencirc.10ba42fb	20200718	1.0.0.1
CrowdStrike	win/malicious_confidence_70% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619464088.452875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619464129.061875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619509122.487751 GetComputerNameW	computer_name: OSKAR-PC	success	1

Command line console output was observed (29 个事件)

Time & API	Arguments	Status	Return
1619509481.92943 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619509384.414148 WriteConsoleA	buffer: ÕýÔÚ Ping 127.0.0.1 console_handle: 0x00000007	success	1
1619509384.773148 WriteConsoleA	buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý: console_handle: 0x00000007	success	1
1619509394.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509394.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509394.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509394.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509395.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509395.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509395.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509395.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509396.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509396.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509396.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509396.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509397.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509397.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509397.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509397.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509398.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509398.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509398.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509398.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509399.273148 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619509399.273148 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619509399.273148 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619509399.273148 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619509405.586148 WriteConsoleA	buffer: 127.0.0.1 µÄ Ping Í³¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒÑ½ÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬ console_handle: 0x00000007	success	1
1619509405.617148 WriteConsoleA	buffer: Íù·µÐÐ³ÌµÄ¹À¼ÆÊ±¼ä(ÒÔºÁÃëÎªµ¥Î»): ×î¶Ì = 0ms£¬×î³¤ = 0ms£¬Æ½¾ù = 0ms console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619509380.992148 GlobalMemoryStatusEx		success	1	0

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	GIF
resource name	PNG

One or more processes crashed (4 个事件)

Time & API	Arguments	Status
1619464129.061875 __exception__	stacktrace: RtlConvertSidToUnicodeString+0x28 RtlFormatCurrentUserKeyPath-0x257 ntdll+0x3aeea @ 0x77d6aeea ConvertSidToStringSidW+0x24 CopySid-0xe6 advapi32+0x14368 @ 0x76554368 4927f738b3a5003b73fd6654f1dc4bdc+0xa6f6 @ 0x40a6f6 4927f738b3a5003b73fd6654f1dc4bdc+0x898b @ 0x40898b 4927f738b3a5003b73fd6654f1dc4bdc+0x8586 @ 0x408586 4927f738b3a5003b73fd6654f1dc4bdc+0x9001 @ 0x409001 4927f738b3a5003b73fd6654f1dc4bdc+0x17ce @ 0x4017ce 4927f738b3a5003b73fd6654f1dc4bdc+0x1c68 @ 0x401c68 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1632744 registers.edi: 0 registers.eax: 9460301 registers.ebp: 1632784 registers.edx: 2 registers.ebx: 1 registers.esi: 9460301 registers.ecx: 9460301 exception.instruction_r: 8a 08 80 e1 0f 80 f9 01 75 24 8a 48 01 80 f9 0f exception.symbol: RtlValidSid+0x17 RtlCopySid-0x3e ntdll+0x392a9 exception.instruction: mov cl, byte ptr [eax] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234153 exception.address: 0x77d692a9	success
1619464163.327875 __exception__	stacktrace: EqualSid+0x19 EqualPrefixSid-0xc kernelbase+0x1bfe3 @ 0x778fbfe3 4927f738b3a5003b73fd6654f1dc4bdc+0x85fd @ 0x4085fd 4927f738b3a5003b73fd6654f1dc4bdc+0xa3b6 @ 0x40a3b6 4927f738b3a5003b73fd6654f1dc4bdc+0xa3f1 @ 0x40a3f1 4927f738b3a5003b73fd6654f1dc4bdc+0x909e @ 0x40909e 4927f738b3a5003b73fd6654f1dc4bdc+0x17ce @ 0x4017ce 4927f738b3a5003b73fd6654f1dc4bdc+0x1c68 @ 0x401c68 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634132 registers.edi: 9460301 registers.eax: 1281 registers.ebp: 1634140 registers.edx: 0 registers.ebx: 40958216 registers.esi: 40958216 registers.ecx: 2130563072 exception.instruction_r: 66 3b 07 0f 85 e1 ef ff ff 0f b6 4e 01 33 c0 8d exception.symbol: RtlEqualSid+0x10 RtlSetCriticalSectionSpinCount-0x26 ntdll+0x394c1 exception.instruction: cmp ax, word ptr [edi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234689 exception.address: 0x77d694c1	success
1619509130.190751 __exception__	stacktrace: 4927f738b3a5003b73fd6654f1dc4bdc+0x3f07 @ 0x403f07 4927f738b3a5003b73fd6654f1dc4bdc+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7806544 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 4927f738b3a5003b73fd6654f1dc4bdc+0x3449 exception.instruction: in eax, dx exception.module: 4927f738b3a5003b73fd6654f1dc4bdc.exe exception.exception_code: 0xc0000096 exception.offset: 13385 exception.address: 0x403449	success
1619509130.190751 __exception__	stacktrace: 4927f738b3a5003b73fd6654f1dc4bdc+0x3f10 @ 0x403f10 4927f738b3a5003b73fd6654f1dc4bdc+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637628 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7806544 registers.ecx: 20 exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0 exception.symbol: 4927f738b3a5003b73fd6654f1dc4bdc+0x34e2 exception.instruction: in eax, dx exception.module: 4927f738b3a5003b73fd6654f1dc4bdc.exe exception.exception_code: 0xc0000096 exception.offset: 13538 exception.address: 0x4034e2	success

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619464073.046875 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 225280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1619464087.593875 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 221184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00650000	success
1619464087.608875 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619509098.862751 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 225280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1619509122.034751 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 221184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00650000	success
1619509122.034751 NtProtectVirtualMemory	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success

Foreign language identified in PE resource (25 个事件)

name

GIF

language

LANG_CHINESE

offset

0x001caf6c

filetype

GIF image data, version 89a, 64 x 64

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00001696

name

PNG

language

LANG_CHINESE

offset

0x001cd148

filetype

PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000ba1

name

PNG

language

LANG_CHINESE

offset

0x001cd148

filetype

PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000ba1

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x001fddbc

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x0020033c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000012c

Creates a suspicious process (2 个事件)

cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe"

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619464089.061875 CreateProcessInternalW	thread_identifier: 2424 thread_handle: 0x0000013c process_identifier: 1688 current_directory: filepath: track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe /C filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000140 inherit_handles: 0	success	1	0
1619464295.186875 ShellExecuteExW	parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)

Time & API	Arguments	Status	Return
1619509475.315751 Process32NextW	process_name: WMIADAP.exe snapshot_handle: 0x0000013c process_identifier: 1728	success	1
1619509475.315751 Process32NextW	process_name: conhost.exe snapshot_handle: 0x0000013c process_identifier: 2652	success	1
1619509475.315751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000013c process_identifier: 428	success	1
1619509475.315751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000013c process_identifier: 296	success	1
1619509475.315751 Process32NextW	process_name: WmiPrvSE.exe snapshot_handle: 0x0000013c process_identifier: 1232	success	1
1619509475.315751 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000013c process_identifier: 1360	success	1

Expresses interest in specific running processes (1 个事件)

process

vboxservice.exe

Uses Windows utilities for basic Windows functionality (3 个事件)

cmdline	ping.exe -n 6 127.0.0.1
cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4927f738b3a5003b73fd6654f1dc4bdc.exe"

Communicates with host for which no DNS query was performed (2 个事件)

host	203.208.41.34
host	203.208.41.65

Detects VMWare through the in instruction feature (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619509130.190751 __exception__	stacktrace: 4927f738b3a5003b73fd6654f1dc4bdc+0x3f07 @ 0x403f07 4927f738b3a5003b73fd6654f1dc4bdc+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7806544 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 4927f738b3a5003b73fd6654f1dc4bdc+0x3449 exception.instruction: in eax, dx exception.module: 4927f738b3a5003b73fd6654f1dc4bdc.exe exception.exception_code: 0xc0000096 exception.offset: 13385 exception.address: 0x403449	success	0	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

MicroWorld-eScan	Gen:Variant.Razy.667778
FireEye	Generic.mg.4927f738b3a5003b
CAT-QuickHeal	Trojan.QbotPMF.S13245366
Qihoo-360	Generic/HEUR/QVM20.1.1434.Malware.Gen
ALYac	Backdoor.QBot.gen
Cylance	Unsafe
Zillya	Trojan.Qbot.Win32.8156
Sangfor	Malware
K7AntiVirus	Trojan ( 0056715d1 )
Alibaba	TrojanBanker:Win32/BankerX.dec05a53
K7GW	Trojan ( 0056715d1 )
Cybereason	malicious.6cb2c4
Arcabit	Trojan.Razy.DA3082
Invincea	heuristic
Symantec	Packed.Generic.459
ESET-NOD32	Win32/Qbot.CC
APEX	Malicious
Paloalto	generic.ml
GData	Gen:Variant.Razy.667778
Kaspersky	HEUR:Trojan-Banker.Win32.Qbot.pef
BitDefender	Gen:Variant.Razy.667778
NANO-Antivirus	Trojan.Win32.Inject3.hkabsx
Avast	Win32:BankerX-gen [Trj]
Rising	Trojan.Kryptik!1.C427 (CLOUD)
Ad-Aware	Gen:Variant.Razy.667778
Sophos	Mal/EncPk-APV
Comodo	Malware@#geu30xmrfgij
F-Secure	Trojan.TR/Qbot.fkvov
DrWeb	Trojan.Inject3.39661
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.Win32.QAKBOT.SME
Emsisoft	Gen:Variant.Razy.667778 (B)
SentinelOne	DFI - Malicious PE
Jiangmin	Trojan.Banker.Qbot.on
Avira	TR/Qbot.fkvov
Antiy-AVL	Trojan[Banker]/Win32.Qbot
Microsoft	Trojan:Win32/Dridex.RAC!MTB
Endgame	malicious (high confidence)
AegisLab	Trojan.Win32.Razy.4!c
ZoneAlarm	HEUR:Trojan-Banker.Win32.Qbot.pef
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R335605
Acronis	suspicious
McAfee	W32/PinkSbot-GN!4927F738B3A5
MAX	malware (ai score=89)
VBA32	TrojanBanker.Qbot
Malwarebytes	Trojan.Qbot
TrendMicro-HouseCall	Backdoor.Win32.QAKBOT.SME
Tencent	Malware.Win32.Gencirc.10ba42fb
Ikarus	Backdoor.QBot

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	203.208.41.34:443
dead_host	172.217.160.78:443
dead_host	192.168.56.101:49190

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-08 04:14:08

Imports

Library KERNEL32.dll:

• 0x5c93bc TlsSetValue

• 0x5c93c0 TlsGetValue

• 0x5c93c4 LocalAlloc

• 0x5c93c8 GetModuleHandleW

• 0x5c93cc lstrlenW

• 0x5c93d0 lstrcmpA

• 0x5c93d4 WriteProcessMemory

• 0x5c93d8 WriteFile

• 0x5c93dc WideCharToMultiByte

• 0x5c93e0 WaitForSingleObject

• 0x5c93e4 WaitForMultipleObjectsEx

• 0x5c93e8 VirtualQueryEx

• 0x5c93ec VirtualQuery

• 0x5c93f0 VirtualProtectEx

• 0x5c93f4 VirtualProtect

• 0x5c93f8 VirtualFree

• 0x5c93fc VirtualAlloc

• 0x5c9400 UnmapViewOfFile

• 0x5c9404 TerminateThread

• 0x5c9408 TerminateProcess

• 0x5c940c SystemTimeToFileTime

• 0x5c9410 SuspendThread

• 0x5c9414 Sleep

• 0x5c9418 SizeofResource

• 0x5c941c SetVolumeLabelW

• 0x5c9420 SetThreadPriority

• 0x5c9424 SetThreadContext

• 0x5c9428 SetThreadAffinityMask

• 0x5c942c SetPriorityClass

• 0x5c9430 SetLastError

• 0x5c9434 SetFilePointer

• 0x5c9438 SetEvent

• 0x5c943c SetErrorMode

• 0x5c9440 SetEndOfFile

• 0x5c9444 ResumeThread

• 0x5c9448 ResetEvent

• 0x5c944c ReleaseSemaphore

• 0x5c9450 ReleaseMutex

• 0x5c9454 ReadProcessMemory

• 0x5c9458 ReadFile

• 0x5c945c QueryPerformanceFrequency

• 0x5c9460 QueryPerformanceCounter

• 0x5c9464 PulseEvent

• 0x5c9468 OutputDebugStringW

• 0x5c946c OpenProcess

• 0x5c9470 OpenMutexW

• 0x5c9474 OpenFileMappingA

• 0x5c9478 OpenEventA

• 0x5c947c MultiByteToWideChar

• 0x5c9480 MulDiv

• 0x5c9484 MapViewOfFile

• 0x5c9488 LockResource

• 0x5c948c LocalFree

• 0x5c9490 LocalFileTimeToFileTime

• 0x5c9494 LoadResource

• 0x5c9498 LoadLibraryExA

• 0x5c949c LoadLibraryExW

• 0x5c94a0 LoadLibraryA

• 0x5c94a4 LoadLibraryW

• 0x5c94a8 LeaveCriticalSection

• 0x5c94ac InitializeCriticalSection

• 0x5c94b0 GetVolumeInformationA

• 0x5c94b4 GetLastError

Library USER32.dll:

• 0x5c94bc GetDoubleClickTime

• 0x5c94c0 LoadIconA

Library GDI32.dll:

• 0x5c94c8 TranslateCharsetInfo

• 0x5c94cc StretchDIBits

• 0x5c94d0 StretchBlt

• 0x5c94d4 SetStretchBltMode

• 0x5c94d8 SetBkMode

• 0x5c94dc SetBkColor

• 0x5c94e0 SelectObject

• 0x5c94e4 SelectClipRgn

• 0x5c94e8 GetTextExtentPointW

• 0x5c94ec GetTextExtentPoint32W

• 0x5c94f0 GetPaletteEntries

• 0x5c94f4 GetObjectW

• 0x5c94f8 GetNearestPaletteIndex

• 0x5c94fc GetDeviceCaps

• 0x5c9500 GetDIBits

• 0x5c9504 DeleteObject

• 0x5c9508 DeleteDC

• 0x5c950c CreateRoundRectRgn

• 0x5c9510 CreateRectRgn

• 0x5c9514 CreatePalette

• 0x5c9518 CreateFontIndirectW

• 0x5c951c CreateDIBitmap

• 0x5c9520 CreateDIBSection

• 0x5c9524 CreateCompatibleDC

• 0x5c9528 CreateCompatibleBitmap

• 0x5c952c CreateBitmap

• 0x5c9530 BitBlt

• 0x5c9534 GetStockObject

• 0x5c9538 GetEnhMetaFileW

Library ADVAPI32.dll:

• 0x5c9540 RegOpenKeyA

• 0x5c9544 RegQueryValueExA

Library COMCTL32.dll:

• 0x5c954c ImageList_GetIconSize

• 0x5c9550 ImageList_Write

• 0x5c9554 ImageList_Read

• 0x5c9558 ImageList_GetIcon

• 0x5c955c ImageList_ReplaceIcon

• 0x5c9560 ImageList_GetImageCount

• 0x5c9564 ImageList_Destroy

• 0x5c9568 ImageList_Create

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com A 172.217.160.78	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.