7.2
高危
58 个模型检测该样本为恶意！
重新分析
更多

b4e39383f52acb66962fa77ad8de72af20529f2c5a96ea181e494dc0df8b9451

54dc2f58296d60bc218460bbf65a7b5a.exe

分析耗时

77s

最近分析

文件大小

78.0KB
静态报毒 动态报毒 100% AI SCORE=100 ALI2000005 AUTOIT BLADABINDI BUCASPYS CLASSIC CONFIDENCE ELDORADO EMW@AEROP5F FDNN GDSDA HHBHOB HIGH CONFIDENCE LIMERAT MALICIOUS PE MALWARE@#1DQXX5BVR47V3 MSILPKILL NJRAT R + MAL R263168 RENTS SCORE SMJC4 STARTER STATIC AI SXEY UNSAFE YAKBEEXMSIL ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee BackDoor-FDNN!54DC2F58296D 20201229 6.0.6.653
Alibaba Trojan:Win32/Starter.ali2000005 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu MSIL.Backdoor.Bladabindi.a 20190318 1.0.0.2
Avast MSIL:Bladabindi-JK [Trj] 20201229 21.1.5827.0
Kingsoft 20201229 2017.9.26.565
Tencent Msil.Worm.Agent.Sxey 20201229 1.0.0.1
静态指标
Queries for the computername (5 个事件)
Time & API Arguments Status Return Repeated
1619455954.747625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455954.934875
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455971.981625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455962.481125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619455962.762502
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619426986.134979
IsDebuggerPresent
failed 0 0
1619455961.481625
IsDebuggerPresent
failed 0 0
Command line console output was observed (5 个事件)
Time & API Arguments Status Return Repeated
1619455954.778625
WriteConsoleW
buffer: 错误:
console_handle: 0x0000000b
success 1 0
1619455954.778625
WriteConsoleW
buffer: 系统找不到指定的文件。
console_handle: 0x0000000b
success 1 0
1619455955.793875
WriteConsoleW
buffer: 成功: 成功创建计划任务 "NYAN"。
console_handle: 0x00000007
success 1 0
1619455962.793125
WriteConsoleW
buffer: 成功: 计划的任务 "NYAN" 被成功删除。
console_handle: 0x00000007
success 1 0
1619455962.903502
WriteConsoleW
buffer: 成功: 成功创建计划任务 "NYAN"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619426994.275979
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619455969.262625
__exception__
stacktrace: 
0x7020d5
mscorlib+0x216e76 @ 0x720f6e76
mscorlib+0x2202ff @ 0x721002ff
mscorlib+0x216df4 @ 0x720f6df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x73fd3191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x73f8192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x73f818cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x73f817f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x73f8197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x73fd2f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x73fd303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x7409805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 75296816
registers.edi: 39771436
registers.eax: 39719320
registers.ebp: 75296856
registers.edx: 39771436
registers.ebx: 39772148
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 39 09 e8 75 25 96 71 8b c8 e8 2e 2a 8c 73 8b f0
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7022c8
success 0 0
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain turk3i.ddns.net
Allocates read-write-execute memory (usually to unpack itself) (50 个事件)
Time & API Arguments Status Return Repeated
1619426985.040979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00620000
success 0 0
1619426985.040979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00700000
success 0 0
1619426985.962979
NtProtectVirtualMemory
process_identifier: 364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619426986.134979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1619426986.134979
NtProtectVirtualMemory
process_identifier: 364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619426986.134979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00572000
success 0 0
1619426986.322979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00582000
success 0 0
1619426986.525979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00583000
success 0 0
1619426986.556979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005bb000
success 0 0
1619426986.556979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005b7000
success 0 0
1619426986.587979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058c000
success 0 0
1619426986.759979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00750000
success 0 0
1619426987.072979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00584000
success 0 0
1619426987.322979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00585000
success 0 0
1619426987.369979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005aa000
success 0 0
1619426987.400979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a2000
success 0 0
1619426987.587979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1619426987.697979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619426987.978979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059a000
success 0 0
1619426987.978979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619426993.087979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00751000
success 0 0
1619426994.103979
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057b000
success 0 0
1619455961.387625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x003e0000
success 0 0
1619455961.387625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00410000
success 0 0
1619455961.434625
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619455961.481625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0046a000
success 0 0
1619455961.481625
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619455961.481625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00462000
success 0 0
1619455961.778625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00472000
success 0 0
1619455961.809625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00473000
success 0 0
1619455961.809625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004cb000
success 0 0
1619455961.809625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004c7000
success 0 0
1619455961.825625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047c000
success 0 0
1619455961.840625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00700000
success 0 0
1619455961.918625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00474000
success 0 0
1619455962.012625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00475000
success 0 0
1619455962.012625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004aa000
success 0 0
1619455962.012625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a2000
success 0 0
1619455962.028625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00477000
success 0 0
1619455962.028625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047a000
success 0 0
1619455962.262625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0049a000
success 0 0
1619455962.262625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00497000
success 0 0
1619455967.356625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00701000
success 0 0
1619455969.215625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0046b000
success 0 0
1619455969.231625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004c5000
success 0 0
1619455969.247625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00702000
success 0 0
1619455969.278625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00496000
success 0 0
1619455970.403625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04720000
success 0 0
1619455971.622625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00478000
success 0 0
1619455971.981625
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04721000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\system.exe
Creates hidden or system file (2 个事件)
Time & API Arguments Status Return Repeated
1619455968.356625
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\system.exe
filepath: C:\Users\Administrator.Oskar-PC\system.exe
success 1 0
1619455969.231625
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\system.exe
filepath: C:\Users\Administrator.Oskar-PC\system.exe
success 1 0
Creates a suspicious process (3 个事件)
cmdline schtasks /create /tn NYAN /tr "C:\Users\Administrator.Oskar-PC\system.exe" /sc minute /mo 1
cmdline schtasks /create /tn NYAN /tr "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\54dc2f58296d60bc218460bbf65a7b5a.exe" /sc minute /mo 1
cmdline schtasks /Delete /tn NYAN /F
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\system.exe
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619455969.278625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline schtasks /create /tn NYAN /tr "C:\Users\Administrator.Oskar-PC\system.exe" /sc minute /mo 1
cmdline schtasks /create /tn NYAN /tr "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\54dc2f58296d60bc218460bbf65a7b5a.exe" /sc minute /mo 1
cmdline schtasks /Delete /tn NYAN /F
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Installs itself for autorun at Windows startup (50 out of 92 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system.exe reg_value "C:\Users\Administrator.Oskar-PC\system.exe" ..
Attempts to modify Explorer settings to prevent hidden files from being displayed (1 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.Ransom.REntS.Gen.1
FireEye Generic.mg.54dc2f58296d60bc
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee BackDoor-FDNN!54DC2F58296D
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
K7AntiVirus Trojan ( 700000121 )
Alibaba Trojan:Win32/Starter.ali2000005
K7GW Trojan ( 700000121 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Ransom.REntS.Gen.1
BitDefenderTheta Gen:NN.ZemsilF.34700.emW@aeROP5f
Cyren W32/Trojan.BVX.gen!Eldorado
Symantec Trojan Horse
Baidu MSIL.Backdoor.Bladabindi.a
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.B-468
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Heur.Ransom.REntS.Gen.1
NANO-Antivirus Trojan.Win32.Bladabindi.hhbhob
AegisLab Trojan.Win32.Generic.4!c
Avast MSIL:Bladabindi-JK [Trj]
Rising Backdoor.Njrat!1.9E49 (CLASSIC)
Ad-Aware Gen:Heur.Ransom.REntS.Gen.1
Emsisoft Gen:Heur.Ransom.REntS.Gen.1 (B)
Comodo Malware@#1dqxx5bvr47v3
F-Secure Trojan.TR/Dropper.Gen
DrWeb BackDoor.Bladabindi.15045
Zillya Worm.Bladabindi.Win32.16977
TrendMicro BKDR_BLADABINDI.SMJC4
McAfee-GW-Edition BehavesLike.Win32.Generic.lm
Sophos Mal/Generic-R + Mal/MsilPKill-C
Ikarus Backdoor.NJRat
Jiangmin TrojanDropper.Autoit.dce
Avira TR/Dropper.Gen
Antiy-AVL Trojan[Backdoor]/MSIL.Bladabindi
Gridinsoft Trojan.Win32.Bladabindi.sb!ni
Microsoft Backdoor:MSIL/Bladabindi.B
ZoneAlarm HEUR:Trojan.Win32.Generic
GData MSIL.Malware.Bucaspys.A
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Bladabindi.R263168
Acronis suspicious
ALYac Gen:Heur.Ransom.REntS.Gen.1
MAX malware (ai score=100)
Malwarebytes Backdoor.LimeRat
ESET-NOD32 a variant of MSIL/Bladabindi.BA
TrendMicro-HouseCall BKDR_BLADABINDI.SMJC4
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-13 01:42:12

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 65005 239.255.255.250 3702
192.168.56.101 65007 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.