10.0
0-day
44 个模型检测该样本为恶意！
重新分析
更多

021ccc0dc12a66983912178b7f4bb87956e03dfc094e03c289e48d3bc499afd2

51d538befc628a222c13482b197dcd80.exe

分析耗时

89s

最近分析

文件大小

636.0KB
静态报毒 动态报毒 100% AI SCORE=88 ATTRIBUTE AVSARHER BUBVUR COBRA CONFIDENCE CRYPTINJECT FAREIT GDSDA HIGH CONFIDENCE HIGHCONFIDENCE HSISEK KRYPTIK MALICIOUS PE MALWARE@#3QN3KE6U8B6NO MSILFC MSILKRYPT NM0@A012RBN NOON PACKEDNET PWSX QVM03 R348272 RAZY S15903483 SCORE SWBD UNSAFE WUUM ZEMSILF ZMUTZY ZXWDY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FYE!51D538BEFC62 20201024 6.0.6.653
Alibaba TrojanSpy:MSIL/CryptInject.a211c40b 20190527 0.3.0.5
Tencent Msil.Trojan.Agent.Swbd 20201024 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20201024 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619444080.15675
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619444098.094625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (22 个事件)
Time & API Arguments Status Return Repeated
1619426982.321148
IsDebuggerPresent
failed 0 0
1619426982.321148
IsDebuggerPresent
failed 0 0
1619427032.040148
IsDebuggerPresent
failed 0 0
1619427032.540148
IsDebuggerPresent
failed 0 0
1619427033.040148
IsDebuggerPresent
failed 0 0
1619427033.540148
IsDebuggerPresent
failed 0 0
1619427034.040148
IsDebuggerPresent
failed 0 0
1619427034.540148
IsDebuggerPresent
failed 0 0
1619427035.040148
IsDebuggerPresent
failed 0 0
1619427035.540148
IsDebuggerPresent
failed 0 0
1619427036.040148
IsDebuggerPresent
failed 0 0
1619427036.540148
IsDebuggerPresent
failed 0 0
1619427037.040148
IsDebuggerPresent
failed 0 0
1619427037.540148
IsDebuggerPresent
failed 0 0
1619427038.040148
IsDebuggerPresent
failed 0 0
1619427038.540148
IsDebuggerPresent
failed 0 0
1619427039.040148
IsDebuggerPresent
failed 0 0
1619427039.540148
IsDebuggerPresent
failed 0 0
1619427040.040148
IsDebuggerPresent
failed 0 0
1619427040.555148
IsDebuggerPresent
failed 0 0
1619444083.719625
IsDebuggerPresent
failed 0 0
1619444083.719625
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619444080.76675
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\ejSikZH"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619426982.368148
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 132 个事件)
Time & API Arguments Status Return Repeated
1619426981.618148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00650000
success 0 0
1619426981.618148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006e0000
success 0 0
1619426981.993148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f80000
success 0 0
1619426981.993148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02120000
success 0 0
1619426982.133148
NtProtectVirtualMemory
process_identifier: 1704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619426982.321148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00650000
success 0 0
1619426982.321148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00650000
success 0 0
1619426982.337148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005da000
success 0 0
1619426982.337148
NtProtectVirtualMemory
process_identifier: 1704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619426982.337148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005d2000
success 0 0
1619426982.712148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e2000
success 0 0
1619426982.946148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00605000
success 0 0
1619426982.946148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0060b000
success 0 0
1619426982.946148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00607000
success 0 0
1619426983.087148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e3000
success 0 0
1619426983.118148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005ec000
success 0 0
1619426983.149148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f20000
success 0 0
1619426983.165148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e4000
success 0 0
1619426983.180148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f21000
success 0 0
1619426983.212148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f22000
success 0 0
1619426983.524148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e5000
success 0 0
1619426983.540148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e7000
success 0 0
1619426983.696148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005fa000
success 0 0
1619426983.696148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005f7000
success 0 0
1619426983.837148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f23000
success 0 0
1619426983.993148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e8000
success 0 0
1619426984.008148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f25000
success 0 0
1619426984.040148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e9000
success 0 0
1619426984.180148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005f6000
success 0 0
1619426984.227148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02160000
success 0 0
1619426984.227148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f26000
success 0 0
1619426984.290148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02161000
success 0 0
1619426984.337148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f27000
success 0 0
1619426984.352148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02162000
success 0 0
1619426984.368148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f28000
success 0 0
1619426984.383148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005ed000
success 0 0
1619427025.883148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f2b000
success 0 0
1619427026.040148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005dc000
success 0 0
1619427026.055148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f2c000
success 0 0
1619427026.087148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02163000
success 0 0
1619427026.087148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f2d000
success 0 0
1619427026.087148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f2e000
success 0 0
1619427026.196148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02164000
success 0 0
1619427026.196148
NtProtectVirtualMemory
process_identifier: 1704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 287232
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x04eb0400
failed 3221225550 0
1619427031.399148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f2f000
success 0 0
1619427031.415148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04920000
success 0 0
1619427031.446148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04921000
success 0 0
1619427031.508148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04922000
success 0 0
1619427031.524148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04923000
success 0 0
1619427031.696148
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02165000
success 0 0
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
cmdline schtasks.exe /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619427037.680148
ShellExecuteExW
parameters: /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.905497275225265 section {'size_of_data': '0x0006c600', 'virtual_address': '0x00002000', 'entropy': 7.905497275225265, 'name': '.text', 'virtual_size': '0x0006c4f4'} description A section with a high entropy has been found
entropy 0.6821400472069237 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619427026.196148
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619444096.906625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
cmdline schtasks.exe /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619427040.415148
NtAllocateVirtualMemory
process_identifier: 2576
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000094f8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619427040.415148
WriteProcessMemory
process_identifier: 2576
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0_à  2¾P `@  @…hPS`À€  H.textÄ0 2 `.rsrcÀ`4@@.reloc €:@B
process_handle: 0x000094f8
base_address: 0x00400000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer:  €P€8€€h€ `4Ôcê44VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°”StringFileInfop000004b0 CommentsHi(CompanyNameHi0FileDescriptionHi,FileVersion1.0.8`InternalNametRttYNSCDWQfAruAOhXybpFSsJ.exe,LegalCopyrightHi0LegalTrademarksHihOriginalFilenametRttYNSCDWQfAruAOhXybpFSsJ.exe(ProductNameHi0ProductVersion1.0.88Assembly Version1.0.8.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x000094f8
base_address: 0x00456000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer: P À0
process_handle: 0x000094f8
base_address: 0x00458000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer: @
process_handle: 0x000094f8
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619427040.415148
WriteProcessMemory
process_identifier: 2576
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0_à  2¾P `@  @…hPS`À€  H.textÄ0 2 `.rsrcÀ`4@@.reloc €:@B
process_handle: 0x000094f8
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1704 called NtSetContextThread to modify thread in remote process 2576
Time & API Arguments Status Return Repeated
1619427040.430148
NtSetContextThread
thread_handle: 0x000069a8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4542654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2576
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1704 resumed a thread in remote process 2576
Time & API Arguments Status Return Repeated
1619427040.649148
NtResumeThread
thread_handle: 0x000069a8
suspend_count: 1
process_identifier: 2576
success 0 0
Executed a process and injected code into it, probably while unpacking (20 个事件)
Time & API Arguments Status Return Repeated
1619426982.321148
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1704
success 0 0
1619426982.352148
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 1704
success 0 0
1619426982.415148
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 1704
success 0 0
1619427032.008148
NtResumeThread
thread_handle: 0x000057a8
suspend_count: 1
process_identifier: 1704
success 0 0
1619427032.024148
NtResumeThread
thread_handle: 0x000002dc
suspend_count: 1
process_identifier: 1704
success 0 0
1619427037.680148
CreateProcessInternalW
thread_identifier: 520
thread_handle: 0x0000bdc4
process_identifier: 2952
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ejSikZH" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp28BC.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000a54
inherit_handles: 0
success 1 0
1619427040.415148
CreateProcessInternalW
thread_identifier: 2216
thread_handle: 0x000069a8
process_identifier: 2576
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000094f8
inherit_handles: 0
success 1 0
1619427040.415148
NtGetContextThread
thread_handle: 0x000069a8
success 0 0
1619427040.415148
NtAllocateVirtualMemory
process_identifier: 2576
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000094f8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619427040.415148
WriteProcessMemory
process_identifier: 2576
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL0_à  2¾P `@  @…hPS`À€  H.textÄ0 2 `.rsrcÀ`4@@.reloc €:@B
process_handle: 0x000094f8
base_address: 0x00400000
success 1 0
1619427040.415148
WriteProcessMemory
process_identifier: 2576
buffer:
process_handle: 0x000094f8
base_address: 0x00402000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer:  €P€8€€h€ `4Ôcê44VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°”StringFileInfop000004b0 CommentsHi(CompanyNameHi0FileDescriptionHi,FileVersion1.0.8`InternalNametRttYNSCDWQfAruAOhXybpFSsJ.exe,LegalCopyrightHi0LegalTrademarksHihOriginalFilenametRttYNSCDWQfAruAOhXybpFSsJ.exe(ProductNameHi0ProductVersion1.0.88Assembly Version1.0.8.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x000094f8
base_address: 0x00456000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer: P À0
process_handle: 0x000094f8
base_address: 0x00458000
success 1 0
1619427040.430148
WriteProcessMemory
process_identifier: 2576
buffer: @
process_handle: 0x000094f8
base_address: 0x7efde008
success 1 0
1619427040.430148
NtSetContextThread
thread_handle: 0x000069a8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4542654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2576
success 0 0
1619427040.649148
NtResumeThread
thread_handle: 0x000069a8
suspend_count: 1
process_identifier: 2576
success 0 0
1619427040.665148
NtResumeThread
thread_handle: 0x00007d9c
suspend_count: 1
process_identifier: 1704
success 0 0
1619444083.719625
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2576
success 0 0
1619444083.750625
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 2576
success 0 0
1619444084.156625
NtResumeThread
thread_handle: 0x000001a0
suspend_count: 1
process_identifier: 2576
success 0 0
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.PackedNET.405
MicroWorld-eScan Gen:Variant.Razy.740733
CAT-QuickHeal Trojan.MsilFC.S15903483
McAfee Fareit-FYE!51D538BEFC62
Sangfor Malware
K7AntiVirus Trojan ( 0056cb4e1 )
BitDefender Gen:Variant.Razy.740733
K7GW Trojan ( 0056cb4e1 )
Cybereason malicious.efc628
Arcabit Trojan.Razy.DB4D7D
BitDefenderTheta Gen:NN.ZemsilF.34590.Nm0@a012rBn
Cyren W32/Trojan.WUUM-8863
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.MSIL.Agent.gen
Alibaba TrojanSpy:MSIL/CryptInject.a211c40b
NANO-Antivirus Trojan.Win32.Noon.hsisek
AegisLab Trojan.MSIL.Agent.4!c
Tencent Msil.Trojan.Agent.Swbd
Ad-Aware Gen:Variant.Razy.740733
Sophos Mal/Generic-S
Comodo Malware@#3qn3ke6u8b6no
VIPRE Trojan.Win32.Generic.pak!cobra
Invincea Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Emsisoft Gen:Variant.Razy.740733 (B)
SentinelOne DFI - Malicious PE
Avira TR/Kryptik.zxwdy
MAX malware (ai score=88)
Microsoft Trojan:MSIL/CryptInject.AR!MTB
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
GData Gen:Variant.Razy.740733
AhnLab-V3 Trojan/Win32.MSILKrypt.R348272
ESET-NOD32 a variant of MSIL/Kryptik.XJJ
Yandex Trojan.AvsArher.bUbVUr
Ikarus Trojan.MSIL.Crypt
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/Zmutzy.CDD!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Generic/HEUR/QVM03.0.52CD.Malware.Gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-18 10:51:28

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.