14.4
0-day
56 个模型检测该样本为恶意！
重新分析
更多

67c94b404e2850bd6a8cfb4cac1487c52079d538bb0ea8455f5bfb1090e91c19

5af5cd7e8fecbeabf3d35c0fbadad3c1.exe

分析耗时

78s

最近分析

文件大小

366.0KB
静态报毒 动态报毒 AGENSLA AI SCORE=81 CLOUD CONFIDENCE DOWNLOADER33 DXEAW ELDORADO GDSDA GENERICKD GENERICRXKN HIGH CONFIDENCE KRYPTIK MALICIOUS PE MALWARE@#2IKHHPKFKHHBV MSILKRYPT NANOCORE PASSWORDSTEALER PWSX QQPASS QQROB R336218 SCORE SUSGEN TAFL THEACBO TROJANPSW UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanPSW:MSIL/NanoCore.5326b043 20190527 0.3.0.5
Avast Win32:PWSX-gen [Trj] 20200528 18.4.3895.0
Tencent Msil.Trojan-qqpass.Qqrob.Tafl 20200529 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200529 2013.8.14.323
McAfee GenericRXKN-OZ!5AF5CD7E8FEC 20200528 6.0.6.653
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619540527.793751
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619540532.637626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619540494.559876
IsDebuggerPresent
failed 0 0
1619540530.965626
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619540528.309751
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\nVbHocjgi"。
console_handle: 0x00000007
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619540532.324626
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Connects to a Dynamic DNS Domain (1 个事件)
domain dikaa.ddns.net
Allocates read-write-execute memory (usually to unpack itself) (50 out of 135 个事件)
Time & API Arguments Status Return Repeated
1619540494.027876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00a40000
success 0 0
1619540494.027876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c10000
success 0 0
1619540494.418876
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619540494.559876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0040a000
success 0 0
1619540494.559876
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619540494.559876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00402000
success 0 0
1619540494.762876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00412000
success 0 0
1619540494.887876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00413000
success 0 0
1619540494.902876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0045b000
success 0 0
1619540494.902876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00457000
success 0 0
1619540494.934876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0041c000
success 0 0
1619540495.340876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00414000
success 0 0
1619540495.355876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00415000
success 0 0
1619540495.402876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00416000
success 0 0
1619540495.418876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00690000
success 0 0
1619540495.527876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0042a000
success 0 0
1619540495.527876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00427000
success 0 0
1619540495.543876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0043a000
success 0 0
1619540495.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0040b000
success 0 0
1619540495.715876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00426000
success 0 0
1619540495.746876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00417000
success 0 0
1619540495.762876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x047a0000
success 0 0
1619540495.762876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04890000
success 0 0
1619540495.762876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04891000
success 0 0
1619540495.793876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04892000
success 0 0
1619540495.871876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00691000
success 0 0
1619540495.887876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04893000
success 0 0
1619540495.887876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04894000
success 0 0
1619540495.918876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04895000
success 0 0
1619540495.934876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00692000
success 0 0
1619540496.012876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00418000
success 0 0
1619540496.059876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00432000
success 0 0
1619540496.121876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00455000
success 0 0
1619540496.355876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c11000
success 0 0
1619540496.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00693000
success 0 0
1619540496.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00419000
success 0 0
1619540496.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04896000
success 0 0
1619540496.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0489a000
success 0 0
1619540496.590876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048ab000
success 0 0
1619540496.605876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048ac000
success 0 0
1619540496.605876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048ad000
success 0 0
1619540496.605876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048ae000
success 0 0
1619540496.621876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00694000
success 0 0
1619540496.621876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048b1000
success 0 0
1619540496.637876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x048b2000
success 0 0
1619540496.637876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00695000
success 0 0
1619540496.684876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x044b0000
success 0 0
1619540527.027876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x044b1000
success 0 0
1619540527.074876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0041a000
success 0 0
1619540530.059876
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00696000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619540527.496876
ShellExecuteExW
parameters: /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.785643253042688 section {'size_of_data': '0x0005ae00', 'virtual_address': '0x00002000', 'entropy': 7.785643253042688, 'name': '.text', 'virtual_size': '0x0005ac48'} description A section with a high entropy has been found
entropy 0.9945280437756497 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619540530.574876
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619540532.277626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.140.53.25
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619540530.277876
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000032c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Looks for the Windows Idle Time to determine the uptime (1 个事件)
Time & API Arguments Status Return Repeated
1619540532.777626
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description RegSvcs.exe tried to sleep 5456388 seconds, actually delayed analysis time by 5456388 seconds
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp
Potential code injection by writing to the memory of another process (3 个事件)
Time & API Arguments Status Return Repeated
1619540530.277876
WriteProcessMemory
process_identifier: 2136
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
process_handle: 0x0000032c
base_address: 0x00400000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer: à ”7
process_handle: 0x0000032c
base_address: 0x00420000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer: @
process_handle: 0x0000032c
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619540530.277876
WriteProcessMemory
process_identifier: 2136
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
process_handle: 0x0000032c
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2224 called NtSetContextThread to modify thread in remote process 2136
Time & API Arguments Status Return Repeated
1619540530.293876
NtSetContextThread
thread_handle: 0x00000380
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2136
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2224 resumed a thread in remote process 2136
Time & API Arguments Status Return Repeated
1619540530.527876
NtResumeThread
thread_handle: 0x00000380
suspend_count: 1
process_identifier: 2136
success 0 0
Executed a process and injected code into it, probably while unpacking (22 个事件)
Time & API Arguments Status Return Repeated
1619540494.559876
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2224
success 0 0
1619540494.621876
NtResumeThread
thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2224
success 0 0
1619540526.934876
NtResumeThread
thread_handle: 0x0000025c
suspend_count: 1
process_identifier: 2224
success 0 0
1619540527.496876
CreateProcessInternalW
thread_identifier: 2296
thread_handle: 0x00000338
process_identifier: 2236
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nVbHocjgi" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD905.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000370
inherit_handles: 0
success 1 0
1619540530.277876
CreateProcessInternalW
thread_identifier: 2412
thread_handle: 0x00000380
process_identifier: 2136
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000032c
inherit_handles: 0
success 1 0
1619540530.277876
NtGetContextThread
thread_handle: 0x00000380
success 0 0
1619540530.277876
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000032c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619540530.277876
WriteProcessMemory
process_identifier: 2136
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTà È`’ç @ €8çW ˜]  H.text˜Ç È `.reloc Ê@B.rsrc˜] ^Ì@@
process_handle: 0x0000032c
base_address: 0x00400000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer:
process_handle: 0x0000032c
base_address: 0x00402000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer: à ”7
process_handle: 0x0000032c
base_address: 0x00420000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer:
process_handle: 0x0000032c
base_address: 0x00422000
success 1 0
1619540530.293876
WriteProcessMemory
process_identifier: 2136
buffer: @
process_handle: 0x0000032c
base_address: 0x7efde008
success 1 0
1619540530.293876
NtSetContextThread
thread_handle: 0x00000380
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4319122
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2136
success 0 0
1619540530.527876
NtResumeThread
thread_handle: 0x00000380
suspend_count: 1
process_identifier: 2136
success 0 0
1619540530.543876
NtResumeThread
thread_handle: 0x00000394
suspend_count: 1
process_identifier: 2224
success 0 0
1619540530.965626
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2136
success 0 0
1619540531.012626
NtResumeThread
thread_handle: 0x00000160
suspend_count: 1
process_identifier: 2136
success 0 0
1619540532.199626
NtResumeThread
thread_handle: 0x00000244
suspend_count: 1
process_identifier: 2136
success 0 0
1619540532.277626
NtResumeThread
thread_handle: 0x00000268
suspend_count: 1
process_identifier: 2136
success 0 0
1619540532.762626
NtResumeThread
thread_handle: 0x00000308
suspend_count: 1
process_identifier: 2136
success 0 0
1619540532.777626
NtResumeThread
thread_handle: 0x0000031c
suspend_count: 1
process_identifier: 2136
success 0 0
1619540534.809626
NtResumeThread
thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2136
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
DrWeb Trojan.DownLoader33.40917
MicroWorld-eScan Trojan.GenericKD.33829019
CAT-QuickHeal Trojan.Nanocore
ALYac Trojan.GenericKD.33829019
Malwarebytes Spyware.PasswordStealer
Zillya Trojan.Kryptik.Win32.2024105
Sangfor Malware
K7AntiVirus Trojan ( 005636691 )
Alibaba TrojanPSW:MSIL/NanoCore.5326b043
K7GW Trojan ( 005636691 )
Cybereason malicious.316fb5
TrendMicro Trojan.MSIL.WACATAC.THEACBO
Cyren W32/MSIL_Agent.BIW.gen!Eldorado
Symantec Trojan.Gen.2
ESET-NOD32 a variant of MSIL/Kryptik.VFR
APEX Malicious
Paloalto generic.ml
GData Trojan.GenericKD.33829019
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.33829019
Avast Win32:PWSX-gen [Trj]
Tencent Msil.Trojan-qqpass.Qqrob.Tafl
Ad-Aware Trojan.GenericKD.33829019
Sophos Mal/Generic-S
Comodo Malware@#2ikhhpkfkhhbv
F-Secure Trojan.TR/Kryptik.dxeaw
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
FireEye Generic.mg.5af5cd7e8fecbeab
Emsisoft Trojan.GenericKD.33829019 (B)
Ikarus Trojan-Spy.Agent
F-Prot W32/MSIL_Agent.BIW.gen!Eldorado
Jiangmin Trojan.PSW.MSIL.yrw
Avira TR/Kryptik.dxeaw
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Endgame malicious (high confidence)
Arcabit Trojan.Generic.D204309B
AegisLab Trojan.MSIL.Agensla.i!c
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft Trojan:MSIL/NanoCore.VN!MTB
AhnLab-V3 Trojan/Win32.MSILKrypt.R336218
Acronis suspicious
McAfee GenericRXKN-OZ!5AF5CD7E8FEC
MAX malware (ai score=81)
Cylance Unsafe
TrendMicro-HouseCall Trojan.MSIL.WACATAC.THEACBO
Rising Trojan.Kryptik!8.8 (CLOUD)
SentinelOne DFI - Malicious PE
eGambit Unsafe.AI_Score_96%
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 192.168.56.101:49185
dead_host 192.168.56.101:49188
dead_host 185.140.53.25:1970
dead_host 192.168.56.101:49187
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-12 14:00:16

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 51808 8.8.4.4 53
192.168.56.101 58367 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.