9.0
极危
56 个模型检测该样本为恶意！
重新分析
更多

7f4913fe7bf295ea965e5d996cbe0d8dc7f4261714817a42a7e4d47ef69503d6

51b8bcb2641768d8839ae1d7b586160b.exe

分析耗时

86s

最近分析

文件大小

580.0KB
静态报毒 动态报毒 100% AIDETECTVM AIHT ATTRIBUTE BAMAPANO CONFIDENCE CRYPTERX DOWNLOADER29 EGJZ ELDORADO FAREIT FAREITVB FSGLUH GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE I34D7I KM0@A0LIX5PI KTSE MALWARE1 MALWARE@#2PLZJF8K0A3BK QAHKQ R + MAL REMCOS RESCOMS RP09 SCORE SM6ZE415PI4 SUSPICIOUS PE UNSAFE VBKRYPT WACATAC X1977 ZEVBAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Generic.bua 20200922 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200922 2013.8.14.323
Tencent 20200922 1.0.0.1
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
静态指标
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain cemileorucs.ddns.net
Allocates read-write-execute memory (usually to unpack itself) (12 个事件)
Time & API Arguments Status Return Repeated
1620752247.047001
NtAllocateVirtualMemory
process_identifier: 1564
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e0000
success 0 0
1620752253.391001
NtAllocateVirtualMemory
process_identifier: 1564
region_size: 67108864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x035e0000
success 0 0
1620752253.438001
NtProtectVirtualMemory
process_identifier: 1564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
1620752254.296876
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003c0000
success 0 0
1620752258.874876
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 67108864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x027f0000
success 0 0
1620752258.905876
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
1620752270.406249
NtAllocateVirtualMemory
process_identifier: 648
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d20000
success 0 0
1620752283.953249
NtAllocateVirtualMemory
process_identifier: 648
region_size: 67108864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03550000
success 0 0
1620752283.953249
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
1620752284.484751
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004b0000
success 0 0
1620752289.687751
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 67108864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02570000
success 0 0
1620752289.749751
NtProtectVirtualMemory
process_identifier: 1888
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 876544
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d40000
success 0 0
Creates a suspicious process (1 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
Drops a binary and executes it (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\51b8bcb2641768d8839ae1d7b586160b.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\51b8bcb2641768d8839ae1d7b586160b.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1620752263.155876
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs
show_type: 0
success 1 0
1620752269.000001
ShellExecuteExW
parameters: /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
filepath: cmd
filepath_r: cmd
show_type: 0
success 1 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620752246.438001
NtProtectVirtualMemory
process_identifier: 1564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00590000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.41.98
Installs itself for autorun at Windows startup (2 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\hpsupport reg_value "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\hpsupport reg_value "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1620752290.280751
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x0040512a
module_address: 0x00000000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 459119 0
One or more non-safelisted processes were created (2 个事件)
parent_process wscript.exe martian_process cmd /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
parent_process wscript.exe martian_process "C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\hpsupport\hpsupport.exe"
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader29.17730
MicroWorld-eScan Trojan.GenericKD.32112509
FireEye Generic.mg.51b8bcb2641768d8
CAT-QuickHeal Trojan.Multi
Qihoo-360 Win32/Trojan.963
McAfee Generic.bua
Cylance Unsafe
Zillya Trojan.Crypt.Win32.59490
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
K7GW Riskware ( 0040eff71 )
Cybereason malicious.7951c2
Arcabit Trojan.Generic.D1E9FF7D
Invincea Mal/Generic-R + Mal/FareitVB-N
BitDefenderTheta Gen:NN.ZevbaF.34254.Km0@a0lIX5pi
Cyren W32/VBKrypt.SB.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Rescoms.B
Zoner Trojan.Win32.81158
TrendMicro-HouseCall Trojan.Win32.BAMAPANO.SM3.hp
Paloalto generic.ml
Kaspersky Trojan.Win32.Crypt.aiht
BitDefender Trojan.GenericKD.32112509
NANO-Antivirus Trojan.Win32.Rescoms.fsgluh
Rising Trojan.Wacatac!8.10C01 (KTSE)
Ad-Aware Trojan.GenericKD.32112509
Sophos Mal/FareitVB-N
Comodo Malware@#2plzjf8k0a3bk
F-Secure Trojan.TR/AD.Remcos.qahkq
VIPRE Win32.Malware!Drop
TrendMicro Trojan.Win32.BAMAPANO.SM3.hp
McAfee-GW-Edition Generic.bua
SentinelOne DFI - Suspicious PE
Emsisoft Trojan.GenericKD.32112509 (B)
Ikarus Trojan.VB.Crypt
Jiangmin Trojan.Crypt.bzd
Avira TR/AD.Remcos.qahkq
Antiy-AVL Trojan/Win32.Wacatac
Microsoft PWS:Win32/Fareit.D!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm Trojan.Win32.Crypt.aiht
GData Win32.Trojan.Injector.I34D7I
Cynet Malicious (score: 90)
AhnLab-V3 Win-Trojan/VBKrypt.RP09.X1977
VBA32 Trojan.Wacatac
ALYac Trojan.GenericKD.32112509
Malwarebytes Trojan.MalPack.VB
APEX Malicious
The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 个事件)
file C:\Windows\SysWOW64\wscript.exe
file C:\Windows\System32\cmd.exe
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-07-03 14:33:22

Imports

Library MSVBVM60.DLL:
• 0x401000
• 0x401004
• 0x401008 MethCallEngine
• 0x40100c
• 0x401010
• 0x401014
• 0x401018
• 0x40101c
• 0x401020
• 0x401024
• 0x401028
• 0x40102c
• 0x401030
• 0x401034
• 0x401038
• 0x40103c EVENT_SINK_AddRef
• 0x401040
• 0x401044
• 0x401048
• 0x40104c
• 0x401050
• 0x401054 EVENT_SINK_Release
• 0x401058
• 0x401060 __vbaExceptHandler
• 0x401064
• 0x401068
• 0x40106c
• 0x401070
• 0x401074
• 0x401078
• 0x40107c
• 0x401080
• 0x401084
• 0x401088
• 0x40108c
• 0x401090
• 0x401094
• 0x401098
• 0x40109c
• 0x4010a0

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.