8.2
高危
44 个模型检测该样本为恶意！
重新分析
更多

d792bcdab74ab7481aa340c47068c80e56a640075a106ea87a2b460bef111833

4f1e2e29c6c625c0c0e01f46112073e6.exe

分析耗时

87s

最近分析

文件大小

1.2MB
静态报毒 动态报毒 AGENTTESLA AI SCORE=86 ATTRIBUTE DAPATO ELDORADO FAREIT GDSDA GENERICKD GENOME HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALICIOUS PE NN0@ASA8WXE PDWO R011C0WH620 R347026 RATX SIGGEN2 SUSGEN UEZMG@0 UNSAFE ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FXY!4F1E2E29C6C6 20200902 6.0.6.653
Baidu 20190318 1.0.0.2
Alibaba TrojanSpy:MSIL/AgentTesla.2777af1e 20190527 0.3.0.5
Avast Win32:RATX-gen [Trj] 20200902 18.4.3895.0
Tencent Msil.Trojan-dropper.Dapato.Pdwo 20200902 1.0.0.1
Kingsoft 20200902 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (50 out of 124 个事件)
Time & API Arguments Status Return Repeated
1619426980.302279
IsDebuggerPresent
failed 0 0
1619426980.317279
IsDebuggerPresent
failed 0 0
1619426981.739279
IsDebuggerPresent
failed 0 0
1619426982.255279
IsDebuggerPresent
failed 0 0
1619426982.755279
IsDebuggerPresent
failed 0 0
1619426983.255279
IsDebuggerPresent
failed 0 0
1619426983.755279
IsDebuggerPresent
failed 0 0
1619426984.255279
IsDebuggerPresent
failed 0 0
1619426984.755279
IsDebuggerPresent
failed 0 0
1619426985.255279
IsDebuggerPresent
failed 0 0
1619426985.755279
IsDebuggerPresent
failed 0 0
1619426986.255279
IsDebuggerPresent
failed 0 0
1619426986.755279
IsDebuggerPresent
failed 0 0
1619426987.255279
IsDebuggerPresent
failed 0 0
1619426987.755279
IsDebuggerPresent
failed 0 0
1619426988.255279
IsDebuggerPresent
failed 0 0
1619426988.755279
IsDebuggerPresent
failed 0 0
1619426989.255279
IsDebuggerPresent
failed 0 0
1619426989.755279
IsDebuggerPresent
failed 0 0
1619426990.255279
IsDebuggerPresent
failed 0 0
1619426990.755279
IsDebuggerPresent
failed 0 0
1619426991.255279
IsDebuggerPresent
failed 0 0
1619426991.755279
IsDebuggerPresent
failed 0 0
1619426992.255279
IsDebuggerPresent
failed 0 0
1619426992.755279
IsDebuggerPresent
failed 0 0
1619426993.255279
IsDebuggerPresent
failed 0 0
1619426993.755279
IsDebuggerPresent
failed 0 0
1619426994.255279
IsDebuggerPresent
failed 0 0
1619426994.755279
IsDebuggerPresent
failed 0 0
1619426995.255279
IsDebuggerPresent
failed 0 0
1619426995.755279
IsDebuggerPresent
failed 0 0
1619426996.255279
IsDebuggerPresent
failed 0 0
1619426996.755279
IsDebuggerPresent
failed 0 0
1619426997.255279
IsDebuggerPresent
failed 0 0
1619426997.755279
IsDebuggerPresent
failed 0 0
1619426998.255279
IsDebuggerPresent
failed 0 0
1619426998.755279
IsDebuggerPresent
failed 0 0
1619426999.255279
IsDebuggerPresent
failed 0 0
1619426999.755279
IsDebuggerPresent
failed 0 0
1619427000.255279
IsDebuggerPresent
failed 0 0
1619427000.755279
IsDebuggerPresent
failed 0 0
1619427001.255279
IsDebuggerPresent
failed 0 0
1619427001.755279
IsDebuggerPresent
failed 0 0
1619427002.255279
IsDebuggerPresent
failed 0 0
1619427002.755279
IsDebuggerPresent
failed 0 0
1619427003.255279
IsDebuggerPresent
failed 0 0
1619427003.755279
IsDebuggerPresent
failed 0 0
1619427004.255279
IsDebuggerPresent
failed 0 0
1619427004.755279
IsDebuggerPresent
failed 0 0
1619427005.255279
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619426980.364279
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 113 个事件)
Time & API Arguments Status Return Repeated
1619426979.536279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619426979.536279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00890000
success 0 0
1619426979.958279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02170000
success 0 0
1619426979.958279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02340000
success 0 0
1619426980.114279
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619426980.302279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x008d0000
success 0 0
1619426980.302279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00940000
success 0 0
1619426980.317279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619426980.317279
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619426980.317279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1619426980.614279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00542000
success 0 0
1619426980.833279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00565000
success 0 0
1619426980.833279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056b000
success 0 0
1619426980.833279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00567000
success 0 0
1619426981.036279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00543000
success 0 0
1619426981.067279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0054c000
success 0 0
1619426981.130279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e0000
success 0 0
1619426981.130279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00544000
success 0 0
1619426981.146279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e1000
success 0 0
1619426981.146279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e2000
success 0 0
1619426981.146279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e3000
success 0 0
1619426981.177279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e4000
success 0 0
1619426981.177279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e5000
success 0 0
1619426981.364279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00545000
success 0 0
1619426981.442279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e6000
success 0 0
1619426981.755279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e7000
success 0 0
1619426981.755279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00546000
success 0 0
1619426981.755279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00547000
success 0 0
1619426981.942279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00548000
success 0 0
1619426982.052279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619426982.161279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055a000
success 0 0
1619426982.161279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00557000
success 0 0
1619426982.239279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e1000
success 0 0
1619426982.271279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e2000
success 0 0
1619426982.302279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e8000
success 0 0
1619426982.302279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00556000
success 0 0
1619426982.411279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e3000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef40000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef40000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef40000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef48000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef30000
success 0 0
1619426982.427279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
1619426982.458279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e9000
success 0 0
1619426982.458279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e4000
success 0 0
1619426982.458279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0054d000
success 0 0
1619426982.599279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008ea000
success 0 0
1619426982.630279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008eb000
success 0 0
1619426982.708279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e5000
success 0 0
1619427040.146279
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00941000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 4f1e2e29c6c625c0c0e01f46112073e6.exe tried to sleep 186 seconds, actually delayed analysis time by 186 seconds
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.593380894921609 section {'size_of_data': '0x00134e00', 'virtual_address': '0x00002000', 'entropy': 7.593380894921609, 'name': '.text', 'virtual_size': '0x00134da4'} description A section with a high entropy has been found
entropy 0.9979806138933764 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619426981.489279
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619431129.77275
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619427040.942279
NtAllocateVirtualMemory
process_identifier: 1344
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000025c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619427040.942279
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÐê^à Tîs €@ À@…œsO€    H.textôS T `.rsrc €V@@.reloc  Z@B
process_handle: 0x0000025c
base_address: 0x00400000
success 1 0
1619427040.958279
WriteProcessMemory
process_identifier: 1344
buffer: €0€HX€ÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNameXpDgzTgfuIBbTSfcjfyJcZvxxrTePvoMezQWUQu.exe(LegalCopyright €,OriginalFilenameXpDgzTgfuIBbTSfcjfyJcZvxxrTePvoMezQWUQu.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x0000025c
base_address: 0x00448000
success 1 0
1619427040.958279
WriteProcessMemory
process_identifier: 1344
buffer: p ð3
process_handle: 0x0000025c
base_address: 0x0044a000
success 1 0
1619427040.974279
WriteProcessMemory
process_identifier: 1344
buffer: @
process_handle: 0x0000025c
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619427040.942279
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÐê^à Tîs €@ À@…œsO€    H.textôS T `.rsrc €V@@.reloc  Z@B
process_handle: 0x0000025c
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 392 called NtSetContextThread to modify thread in remote process 1344
Time & API Arguments Status Return Repeated
1619427040.974279
NtSetContextThread
thread_handle: 0x00000254
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4486126
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1344
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 392 resumed a thread in remote process 1344
Time & API Arguments Status Return Repeated
1619427041.302279
NtResumeThread
thread_handle: 0x00000254
suspend_count: 1
process_identifier: 1344
success 0 0
Executed a process and injected code into it, probably while unpacking (18 个事件)
Time & API Arguments Status Return Repeated
1619426980.317279
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 392
success 0 0
1619426980.317279
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 392
success 0 0
1619426980.380279
NtResumeThread
thread_handle: 0x00000164
suspend_count: 1
process_identifier: 392
success 0 0
1619426981.708279
NtResumeThread
thread_handle: 0x00000200
suspend_count: 1
process_identifier: 392
success 0 0
1619426981.724279
NtResumeThread
thread_handle: 0x00000218
suspend_count: 1
process_identifier: 392
success 0 0
1619427040.942279
CreateProcessInternalW
thread_identifier: 2576
thread_handle: 0x00000254
process_identifier: 1344
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f1e2e29c6c625c0c0e01f46112073e6.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f1e2e29c6c625c0c0e01f46112073e6.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x0000025c
inherit_handles: 0
success 1 0
1619427040.942279
NtGetContextThread
thread_handle: 0x00000254
success 0 0
1619427040.942279
NtAllocateVirtualMemory
process_identifier: 1344
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000025c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619427040.942279
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÐê^à Tîs €@ À@…œsO€    H.textôS T `.rsrc €V@@.reloc  Z@B
process_handle: 0x0000025c
base_address: 0x00400000
success 1 0
1619427040.942279
WriteProcessMemory
process_identifier: 1344
buffer:
process_handle: 0x0000025c
base_address: 0x00402000
success 1 0
1619427040.958279
WriteProcessMemory
process_identifier: 1344
buffer: €0€HX€ÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNameXpDgzTgfuIBbTSfcjfyJcZvxxrTePvoMezQWUQu.exe(LegalCopyright €,OriginalFilenameXpDgzTgfuIBbTSfcjfyJcZvxxrTePvoMezQWUQu.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x0000025c
base_address: 0x00448000
success 1 0
1619427040.958279
WriteProcessMemory
process_identifier: 1344
buffer: p ð3
process_handle: 0x0000025c
base_address: 0x0044a000
success 1 0
1619427040.974279
WriteProcessMemory
process_identifier: 1344
buffer: @
process_handle: 0x0000025c
base_address: 0x7efde008
success 1 0
1619427040.974279
NtSetContextThread
thread_handle: 0x00000254
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4486126
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1344
success 0 0
1619427041.302279
NtResumeThread
thread_handle: 0x00000254
suspend_count: 1
process_identifier: 1344
success 0 0
1619431117.05375
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1344
success 0 0
1619431117.06975
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 1344
success 0 0
1619431117.28875
NtResumeThread
thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1344
success 0 0
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34294380
FireEye Generic.mg.4f1e2e29c6c625c0
CAT-QuickHeal TrojanDropper.MSIL
McAfee Fareit-FXY!4F1E2E29C6C6
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2336053
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.34294380
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D20B4A6C
TrendMicro TROJ_GEN.R011C0WH620
Cyren W32/MSIL_Kryptik.BHS.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Dropper.MSIL.Dapato.gen
Alibaba TrojanSpy:MSIL/AgentTesla.2777af1e
Avast Win32:RATX-gen [Trj]
Tencent Msil.Trojan-dropper.Dapato.Pdwo
Ad-Aware Trojan.GenericKD.34294380
Comodo TrojWare.Win32.Genome.uezmg@0
DrWeb Trojan.PWS.Siggen2.54033
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
Sophos Mal/Generic-S
SentinelOne DFI - Malicious PE
MAX malware (ai score=86)
Microsoft TrojanSpy:MSIL/AgentTesla.AQ!MTB
ZoneAlarm HEUR:Trojan-Dropper.MSIL.Dapato.gen
GData Trojan.GenericKD.34294380
AhnLab-V3 Trojan/Win32.Kryptik.R347026
BitDefenderTheta Gen:NN.ZemsilF.34216.nn0@aSa8WXe
ALYac Trojan.GenericKD.34294380
VBA32 CIL.HeapOverride.Heur
Malwarebytes Trojan.MalPack
ESET-NOD32 a variant of MSIL/Kryptik.XFR
TrendMicro-HouseCall TROJ_GEN.R011C0WH620
Ikarus Trojan.Inject
Fortinet MSIL/Kryptik.XFR!tr
MaxSecure Trojan.Malware.73693254.susgen
AVG Win32:RATX-gen [Trj]
Panda Trj/GdSda.A
Qihoo-360 Generic/Trojan.Dropper.e44
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-05 12:01:44

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 51811 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.