10.2
0-day
49 个模型检测该样本为恶意！
重新分析
更多

be905b9aac897739d22c1078e60be1111efc7a9ec25e205d664e03a59730dbea

4f23660dde9df05e7429c970ce9027cc.exe

分析耗时

89s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AGENTTESLA AI SCORE=87 ALI1000139 ATTRIBUTE AVSARHER BTJEKX CONFIDENCE ELDORADO FAREIT FORMBOOK GENERICKD GN0@AIKQ@XJ HIGHCONFIDENCE HOPNDC KRYPTIK LOKIBOT MALWARE@#2QGFS8YVNEFBF PACKEDNET PEFZ PWSX R002C0DGH20 R344874 SCORE SRPPW STARTER SUPERWEB TRJOJAN UNSAFE ZEMSILCO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FXG!4F23660DDE9D 20200806 6.0.6.653
Alibaba Trojan:Win32/starter.ali1000139 20190527 0.3.0.5
Avast Win32:PWSX-gen [Trj] 20200806 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200806 2013.8.14.323
Tencent Msil.Trojan.Crypt.Pefz 20200806 1.0.0.1
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619445336.714626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619445338.292501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619445285.292626
IsDebuggerPresent
failed 0 0
1619445285.292626
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619445338.917501
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\JjekBOvmAcHATs"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619445285.339626
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 96 个事件)
Time & API Arguments Status Return Repeated
1619445284.823626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x007e0000
success 0 0
1619445284.823626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008b0000
success 0 0
1619445285.104626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02010000
success 0 0
1619445285.104626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b0000
success 0 0
1619445285.182626
NtProtectVirtualMemory
process_identifier: 2292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619445285.292626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020f0000
success 0 0
1619445285.292626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02220000
success 0 0
1619445285.292626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056a000
success 0 0
1619445285.307626
NtProtectVirtualMemory
process_identifier: 2292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619445285.307626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00562000
success 0 0
1619445285.495626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00572000
success 0 0
1619445285.589626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00695000
success 0 0
1619445285.589626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0069b000
success 0 0
1619445285.589626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00697000
success 0 0
1619445285.682626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00573000
success 0 0
1619445285.729626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057c000
success 0 0
1619445286.120626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00574000
success 0 0
1619445286.135626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00576000
success 0 0
1619445286.245626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b0000
success 0 0
1619445286.354626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00577000
success 0 0
1619445286.401626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02221000
success 0 0
1619445286.401626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02222000
success 0 0
1619445286.464626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00586000
success 0 0
1619445286.479626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b1000
success 0 0
1619445286.479626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02223000
success 0 0
1619445286.479626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02224000
success 0 0
1619445286.526626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02225000
success 0 0
1619445286.526626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02226000
success 0 0
1619445286.526626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0222a000
success 0 0
1619445286.542626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b2000
success 0 0
1619445286.542626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619445286.542626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1619445286.807626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00578000
success 0 0
1619445286.964626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00800000
success 0 0
1619445286.964626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1619445287.042626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00579000
success 0 0
1619445287.214626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00830000
success 0 0
1619445287.354626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00831000
success 0 0
1619445287.354626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00832000
success 0 0
1619445287.557626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00833000
success 0 0
1619445287.604626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00834000
success 0 0
1619445287.620626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b3000
success 0 0
1619445287.667626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057d000
success 0 0
1619445287.667626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00835000
success 0 0
1619445287.682626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b4000
success 0 0
1619445325.714626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b7000
success 0 0
1619445325.917626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b8000
success 0 0
1619445326.026626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056c000
success 0 0
1619445326.089626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b9000
success 0 0
1619445326.135626
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00836000
success 0 0
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619445338.026626
ShellExecuteExW
parameters: /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619445340.776626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (10 个事件)
Time & API Arguments Status Return Repeated
1619445341.042626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2244
process_handle: 0x00000428
failed 0 0
1619445341.042626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2244
process_handle: 0x00000428
success 0 0
1619445341.401626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1752
process_handle: 0x00000468
failed 0 0
1619445341.401626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1752
process_handle: 0x00000468
success 0 0
1619445341.760626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2188
process_handle: 0x00000470
failed 0 0
1619445341.760626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2188
process_handle: 0x00000470
success 0 0
1619445342.151626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1760
process_handle: 0x00000474
failed 0 0
1619445342.151626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1760
process_handle: 0x00000474
success 0 0
1619445342.464626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1244
process_handle: 0x0000047c
failed 0 0
1619445342.464626
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1244
process_handle: 0x0000047c
success 0 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (5 个事件)
Time & API Arguments Status Return Repeated
1619445340.745626
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000420
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.151626
NtAllocateVirtualMemory
process_identifier: 1752
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000418
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.495626
NtAllocateVirtualMemory
process_identifier: 2188
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000430
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.885626
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000444
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445342.245626
NtAllocateVirtualMemory
process_identifier: 1244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000046c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Checks the version of Bios, possibly for anti-virtualization (2 个事件)
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
Manipulates memory of a non-child process indicative of process injection (10 个事件)
Process injection Process 2292 manipulating memory of non-child process 2244
Process injection Process 2292 manipulating memory of non-child process 1752
Process injection Process 2292 manipulating memory of non-child process 2188
Process injection Process 2292 manipulating memory of non-child process 1760
Process injection Process 2292 manipulating memory of non-child process 1244
Time & API Arguments Status Return Repeated
1619445340.745626
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000420
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.151626
NtAllocateVirtualMemory
process_identifier: 1752
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000418
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.495626
NtAllocateVirtualMemory
process_identifier: 2188
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000430
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.885626
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000444
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445342.245626
NtAllocateVirtualMemory
process_identifier: 1244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000046c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Detects VirtualBox through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
Detects VMWare through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Detects the presence of Wine emulator (1 个事件)
Time & API Arguments Status Return Repeated
1619445336.339626
LdrGetProcedureAddress
ordinal: 0
module: KERNEL32
module_address: 0x76340000
function_address: 0x002cd2bc
function_name: wine_get_unix_file_name
failed 3221225785 0
Executed a process and injected code into it, probably while unpacking (21 个事件)
Time & API Arguments Status Return Repeated
1619445285.292626
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2292
success 0 0
1619445285.307626
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 2292
success 0 0
1619445285.354626
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 2292
success 0 0
1619445336.354626
NtResumeThread
thread_handle: 0x00000250
suspend_count: 1
process_identifier: 2292
success 0 0
1619445336.526626
NtResumeThread
thread_handle: 0x000002cc
suspend_count: 1
process_identifier: 2292
success 0 0
1619445338.026626
CreateProcessInternalW
thread_identifier: 2940
thread_handle: 0x00000430
process_identifier: 2120
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JjekBOvmAcHATs" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp259F.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000468
inherit_handles: 0
success 1 0
1619445340.745626
CreateProcessInternalW
thread_identifier: 1632
thread_handle: 0x00000424
process_identifier: 2244
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000420
inherit_handles: 0
success 1 0
1619445340.745626
NtGetContextThread
thread_handle: 0x00000424
success 0 0
1619445340.745626
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000420
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.135626
CreateProcessInternalW
thread_identifier: 1712
thread_handle: 0x00000428
process_identifier: 1752
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000418
inherit_handles: 0
success 1 0
1619445341.151626
NtGetContextThread
thread_handle: 0x00000428
success 0 0
1619445341.151626
NtAllocateVirtualMemory
process_identifier: 1752
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000418
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.495626
CreateProcessInternalW
thread_identifier: 1816
thread_handle: 0x00000468
process_identifier: 2188
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000430
inherit_handles: 0
success 1 0
1619445341.495626
NtGetContextThread
thread_handle: 0x00000468
success 0 0
1619445341.495626
NtAllocateVirtualMemory
process_identifier: 2188
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000430
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445341.885626
CreateProcessInternalW
thread_identifier: 1056
thread_handle: 0x00000470
process_identifier: 1760
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000444
inherit_handles: 0
success 1 0
1619445341.885626
NtGetContextThread
thread_handle: 0x00000470
success 0 0
1619445341.885626
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000444
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619445342.245626
CreateProcessInternalW
thread_identifier: 1812
thread_handle: 0x00000474
process_identifier: 1244
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4f23660dde9df05e7429c970ce9027cc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000046c
inherit_handles: 0
success 1 0
1619445342.245626
NtGetContextThread
thread_handle: 0x00000474
success 0 0
1619445342.245626
NtAllocateVirtualMemory
process_identifier: 1244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000046c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)
DrWeb Trojan.PackedNET.388
MicroWorld-eScan Trojan.GenericKD.43497777
FireEye Generic.mg.4f23660dde9df05e
CAT-QuickHeal Trojan.MSIL
McAfee Fareit-FXG!4F23660DDE9D
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056aa441 )
Alibaba Trojan:Win32/starter.ali1000139
K7GW Trojan ( 0056aa441 )
Cybereason malicious.2e0142
Arcabit Trojan.Generic.D297B931
BitDefenderTheta Gen:NN.ZemsilCO.34152.gn0@aiKq@Xj
Cyren W32/MSIL_Kryptik.BDA.gen!Eldorado
Symantec ML.Attribute.HighConfidence
TrendMicro-HouseCall TROJ_GEN.R002C0DGH20
Paloalto generic.ml
ClamAV Win.Packed.Formbook-9023929-0
Kaspersky HEUR:Trojan.MSIL.Crypt.gen
BitDefender Trojan.GenericKD.43497777
NANO-Antivirus Trojan.Win32.Crypt.hopndc
AegisLab Trojan.MSIL.Crypt.4!c
Avast Win32:PWSX-gen [Trj]
Ad-Aware Trojan.GenericKD.43497777
Emsisoft Trojan.GenericKD.43497777 (B)
Comodo Malware@#2qgfs8yvnefbf
F-Secure Trojan.TR/Kryptik.srppw
TrendMicro TROJ_GEN.R002C0DGH20
Sophos Troj/MSIL-PJA
Ikarus Trjojan.MSIL.Inject
F-Prot W32/MSIL_Kryptik.BDA.gen!Eldorado
Webroot Pua.Superweb
Avira TR/Kryptik.srppw
Microsoft Trojan:MSIL/Formbook.MK!MTB
ZoneAlarm HEUR:Trojan.MSIL.Crypt.gen
GData Trojan.GenericKD.43497777
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.AgentTesla.R344874
ALYac Trojan.GenericKD.43497777
Malwarebytes Spyware.LokiBot
APEX Malicious
ESET-NOD32 a variant of MSIL/Kryptik.WWH
Tencent Msil.Trojan.Crypt.Pefz
Yandex Trojan.AvsArher.bTJEKx
MAX malware (ai score=87)
Fortinet MSIL/Kryptik.WXF!tr
AVG Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Generic/Trojan.21a
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-15 14:58:55

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.