13.0
0-day
60 个模型检测该样本为恶意！
重新分析
更多

22525129004fbb8dbbc180fd0898cc33801cc75a9d6fc1072020ae12b4c2de88

52cd3630aff735161952cdf459899895.exe

分析耗时

77s

最近分析

文件大小

324.5KB
静态报毒 动态报毒 100% ADZO AGENSLA AGENTTESLA AI SCORE=84 AVSARHER BTJEKX CONFIDENCE DOWNLOADER33 ELDORADO FAREIT GENERICKD HIGH CONFIDENCE HKWRJH KTSE LOKIBOT MALICIOUS PE MALWARE@#2RT3M4OTN1OGK MASSLOGGER NANCAT NANOCORE NOANCOOE PWSX QQPASS QQROB R338915 S + MAL SARMU SCORE STATIC AI SUSGEN SWBL TIAOODHB TROJANPSW TSCOPE UM0@AE9LTF UNSAFE VIK2E8 YAKBEEXMSIL ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20201124 20.10.5736.0
Alibaba TrojanPSW:MSIL/Lokibot.4790e729 20190527 0.3.0.5
Kingsoft 20201124 2017.9.26.565
McAfee Fareit-FUI!52CD3630AFF7 20201120 6.0.6.653
Tencent Msil.Trojan-qqpass.Qqrob.Swbl 20201124 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619455376.024125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455384.851625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455381.83675
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619426985.678793
IsDebuggerPresent
failed 0 0
1619455379.742625
IsDebuggerPresent
failed 0 0
Command line console output was observed (2 个事件)
Time & API Arguments Status Return Repeated
1619455376.805125
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\lSPIBO"。
console_handle: 0x00000007
success 1 0
1619455382.22675
WriteConsoleW
buffer: 成功: 成功创建计划任务 "DSL Service"。
console_handle: 0x00000007
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619455384.445625
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 139 个事件)
Time & API Arguments Status Return Repeated
1619426984.725793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00590000
success 0 0
1619426984.725793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00690000
success 0 0
1619426985.459793
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619426985.678793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1619426985.678793
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619426985.678793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00572000
success 0 0
1619426986.069793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00592000
success 0 0
1619426986.272793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00593000
success 0 0
1619426986.288793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005cb000
success 0 0
1619426986.288793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c7000
success 0 0
1619426986.319793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059c000
success 0 0
1619426986.788793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00594000
success 0 0
1619426986.788793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00595000
success 0 0
1619426986.850793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00596000
success 0 0
1619426986.866793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd0000
success 0 0
1619426986.991793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619426987.022793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005ba000
success 0 0
1619426987.053793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a6000
success 0 0
1619426987.053793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005aa000
success 0 0
1619426987.053793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a7000
success 0 0
1619426987.225793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057b000
success 0 0
1619426987.350793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00598000
success 0 0
1619426987.366793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd1000
success 0 0
1619426987.397793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x04970000
success 0 0
1619426987.397793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b10000
success 0 0
1619426987.397793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b11000
success 0 0
1619426987.444793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b12000
success 0 0
1619426987.444793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b13000
success 0 0
1619426987.506793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd2000
success 0 0
1619426987.506793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b14000
success 0 0
1619426987.522793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b15000
success 0 0
1619426987.569793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd3000
success 0 0
1619426987.600793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059a000
success 0 0
1619426987.725793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01010000
success 0 0
1619426987.881793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00599000
success 0 0
1619426987.913793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005b2000
success 0 0
1619426987.959793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c5000
success 0 0
1619426988.241793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00691000
success 0 0
1619426988.319793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd4000
success 0 0
1619426988.397793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x047d0000
success 0 0
1619426988.413793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b16000
success 0 0
1619426988.413793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b1a000
success 0 0
1619426988.413793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b2b000
success 0 0
1619426988.413793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b2c000
success 0 0
1619426988.428793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b2d000
success 0 0
1619426988.428793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b2e000
success 0 0
1619426988.428793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b2f000
success 0 0
1619426988.459793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fd5000
success 0 0
1619426988.459793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b32000
success 0 0
1619426988.459793
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04b33000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a suspicious process (3 个事件)
cmdline schtasks.exe /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
cmdline "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp7942.tmp"
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619426989.413793
ShellExecuteExW
parameters: /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
1619455381.336625
CreateProcessInternalW
thread_identifier: 2868
thread_handle: 0x000001f0
process_identifier: 2772
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp7942.tmp"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x000001f4
inherit_handles: 1
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.9243054974011615 section {'size_of_data': '0x0004cc00', 'virtual_address': '0x00002000', 'entropy': 7.9243054974011615, 'name': '.text', 'virtual_size': '0x0004cb1c'} description A section with a high entropy has been found
entropy 0.9475308641975309 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619455384.367625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline schtasks.exe /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
cmdline "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp7942.tmp"
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619426992.959793
NtAllocateVirtualMemory
process_identifier: 2740
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000003a8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Looks for the Windows Idle Time to determine the uptime (1 个事件)
Time & API Arguments Status Return Repeated
1619455384.883625
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 52cd3630aff735161952cdf459899895.exe tried to sleep 5456505 seconds, actually delayed analysis time by 5456505 seconds
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp
Potential code injection by writing to the memory of another process (3 个事件)
Time & API Arguments Status Return Repeated
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èb’ç @ €8çW È_  H.text˜Ç È `.reloc Ê@B.rsrcÈ_ `Ì@@
process_handle: 0x000003a8
base_address: 0x00400000
success 1 0
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer: à ”7
process_handle: 0x000003a8
base_address: 0x00420000
success 1 0
1619426992.975793
WriteProcessMemory
process_identifier: 2740
buffer: @
process_handle: 0x000003a8
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èb’ç @ €8çW È_  H.text˜Ç È `.reloc Ê@B.rsrcÈ_ `Ì@@
process_handle: 0x000003a8
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3040 called NtSetContextThread to modify thread in remote process 2740
Time & API Arguments Status Return Repeated
1619426992.975793
NtSetContextThread
thread_handle: 0x00000354
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2740
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\52cd3630aff735161952cdf459899895.exe:Zone.Identifier
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3040 resumed a thread in remote process 2740
Time & API Arguments Status Return Repeated
1619426993.225793
NtResumeThread
thread_handle: 0x00000354
suspend_count: 1
process_identifier: 2740
success 0 0
Executed a process and injected code into it, probably while unpacking (21 个事件)
Time & API Arguments Status Return Repeated
1619426985.678793
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 3040
success 0 0
1619426985.741793
NtResumeThread
thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 3040
success 0 0
1619426988.694793
NtResumeThread
thread_handle: 0x00000284
suspend_count: 1
process_identifier: 3040
success 0 0
1619426989.413793
CreateProcessInternalW
thread_identifier: 2292
thread_handle: 0x00000360
process_identifier: 2988
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSPIBO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6174.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000398
inherit_handles: 0
success 1 0
1619426992.944793
CreateProcessInternalW
thread_identifier: 2712
thread_handle: 0x00000354
process_identifier: 2740
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\52cd3630aff735161952cdf459899895.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\52cd3630aff735161952cdf459899895.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000003a8
inherit_handles: 0
success 1 0
1619426992.959793
NtGetContextThread
thread_handle: 0x00000354
success 0 0
1619426992.959793
NtAllocateVirtualMemory
process_identifier: 2740
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000003a8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà Èb’ç @ €8çW È_  H.text˜Ç È `.reloc Ê@B.rsrcÈ_ `Ì@@
process_handle: 0x000003a8
base_address: 0x00400000
success 1 0
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer:
process_handle: 0x000003a8
base_address: 0x00402000
success 1 0
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer: à ”7
process_handle: 0x000003a8
base_address: 0x00420000
success 1 0
1619426992.959793
WriteProcessMemory
process_identifier: 2740
buffer:
process_handle: 0x000003a8
base_address: 0x00422000
success 1 0
1619426992.975793
WriteProcessMemory
process_identifier: 2740
buffer: @
process_handle: 0x000003a8
base_address: 0x7efde008
success 1 0
1619426992.975793
NtSetContextThread
thread_handle: 0x00000354
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2740
success 0 0
1619426993.225793
NtResumeThread
thread_handle: 0x00000354
suspend_count: 1
process_identifier: 2740
success 0 0
1619455379.742625
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2740
success 0 0
1619455379.836625
NtResumeThread
thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 2740
success 0 0
1619455381.336625
CreateProcessInternalW
thread_identifier: 2868
thread_handle: 0x000001f0
process_identifier: 2772
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp7942.tmp"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x000001f4
inherit_handles: 1
success 1 0
1619455383.961625
NtResumeThread
thread_handle: 0x00000284
suspend_count: 1
process_identifier: 2740
success 0 0
1619455384.258625
NtResumeThread
thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 2740
success 0 0
1619455384.367625
NtResumeThread
thread_handle: 0x000002dc
suspend_count: 1
process_identifier: 2740
success 0 0
1619455385.383625
NtResumeThread
thread_handle: 0x00000360
suspend_count: 1
process_identifier: 2740
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.33946085
FireEye Generic.mg.52cd3630aff73516
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
ALYac Trojan.GenericKD.33946085
Cylance Unsafe
Zillya Trojan.NanoCore.Win32.6905
Sangfor Malware
K7AntiVirus Trojan ( 004bec131 )
BitDefender Trojan.GenericKD.33946085
K7GW Trojan ( 004bec131 )
Cybereason malicious.ceba37
Cyren W32/MSIL_Agent.BJN.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Trojan.MassLogger-8982600-0
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba TrojanPSW:MSIL/Lokibot.4790e729
NANO-Antivirus Trojan.Win32.NanoCore.hkwrjh
AegisLab Trojan.MSIL.Agensla.i!c
Rising Backdoor.Noancooe!8.176 (KTSE)
Ad-Aware Trojan.GenericKD.33946085
Emsisoft Trojan.GenericKD.33946085 (B)
Comodo Malware@#2rt3m4otn1ogk
F-Secure Trojan.TR/AD.Nanocore.sarmu
DrWeb Trojan.DownLoader33.48586
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.MSIL.NANOCORE.TIAOODHB
McAfee-GW-Edition Fareit-FUI!52CD3630AFF7
MaxSecure Trojan.Malware.74499699.susgen
Sophos Mal/Generic-S + Mal/Generic-L
Ikarus Trojan.MSIL.Crypt
Jiangmin Trojan.PSW.MSIL.adzo
Webroot W32.Trojan.Gen
Avira TR/AD.Nanocore.sarmu
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Microsoft Trojan:MSIL/Lokibot.VN!MTB
Arcabit Trojan.Generic.D205F9E5
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData MSIL.Backdoor.Nancat.VIK2E8
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.AgentTesla.R338915
McAfee Fareit-FUI!52CD3630AFF7
MAX malware (ai score=84)
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.Crypt.MSIL
Panda Trj/WLT.F
Zoner Trojan.Win32.92201
ESET-NOD32 MSIL/NanoCore.E
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-01 09:06:26

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 50002 8.8.4.4 53
192.168.56.101 51808 8.8.4.4 53
192.168.56.101 53380 8.8.4.4 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.