SmartHawk

8.6

极危

49 个模型检测该样本为恶意！

重新分析

下载样本

c16abbc0365907322571a8ffa573a9c0f5b22d1ec4992cebe3702791fd72817b

5cb7e53c311ab379969ab1cb9bef97c3.exe

分析耗时

101s

最近分析

文件大小

534.0KB

静态报毒动态报毒 100% AEPZ AGEN AGENSLA AI SCORE=82 ATTRIBUTE CONFIDENCE ELDORADO FORMBOOK GDSDA GENCIRC GENERICKD GENERICRXKJ GENKRYPTIK HAWKEY HIGH CONFIDENCE HIGHCONFIDENCE HMW@AEW92SKI KCIGEP4ZPLE KILLPROC2 KRYPTIK MALICIOUS PE MALWARE@#2J4N90XKYMTON S + TROJ SCORE STATIC AI TROJANPSW TROJANX TSCOPE UNSAFE XIMGXY3LXKH ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKJ-XA!5CB7E53C311A	20201229	6.0.6.653
Alibaba	TrojanPSW:MSIL/FormBook.3d4272ca	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201229	21.1.5827.0
Kingsoft		20201229	2017.9.26.565
Tencent	Malware.Win32.Gencirc.1168ee66	20201229	1.0.0.1

Queries for the computername (18 个事件)

Time & API	Arguments	Status	Return
1619518896.385001 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518896.385001 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518902.917626 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518902.917626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518911.964876 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518911.964876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518919.417126 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518919.417126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518925.714126 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518925.714126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518932.214374 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518932.214374 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518950.385751 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518950.385751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518956.339126 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518956.339126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619518965.276751 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619518965.276751 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (50 out of 54 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513302.935008 IsDebuggerPresent		failed	0	0
1619513302.935008 IsDebuggerPresent		failed	0	0
1619518895.729001 IsDebuggerPresent		failed	0	0
1619518895.729001 IsDebuggerPresent		failed	0	0
1619518896.385001 IsDebuggerPresent		failed	0	0
1619518896.385001 IsDebuggerPresent		failed	0	0
1619518899.682001 IsDebuggerPresent		failed	0	0
1619518899.682001 IsDebuggerPresent		failed	0	0
1619518902.495626 IsDebuggerPresent		failed	0	0
1619518902.495626 IsDebuggerPresent		failed	0	0
1619518902.901626 IsDebuggerPresent		failed	0	0
1619518902.901626 IsDebuggerPresent		failed	0	0
1619518908.760126 IsDebuggerPresent		failed	0	0
1619518908.760126 IsDebuggerPresent		failed	0	0
1619518911.323876 IsDebuggerPresent		failed	0	0
1619518911.339876 IsDebuggerPresent		failed	0	0
1619518911.792876 IsDebuggerPresent		failed	0	0
1619518911.792876 IsDebuggerPresent		failed	0	0
1619518916.682501 IsDebuggerPresent		failed	0	0
1619518916.682501 IsDebuggerPresent		failed	0	0
1619518919.120126 IsDebuggerPresent		failed	0	0
1619518919.120126 IsDebuggerPresent		failed	0	0
1619518919.354126 IsDebuggerPresent		failed	0	0
1619518919.354126 IsDebuggerPresent		failed	0	0
1619518923.354751 IsDebuggerPresent		failed	0	0
1619518923.354751 IsDebuggerPresent		failed	0	0
1619518925.214126 IsDebuggerPresent		failed	0	0
1619518925.214126 IsDebuggerPresent		failed	0	0
1619518925.698126 IsDebuggerPresent		failed	0	0
1619518925.698126 IsDebuggerPresent		failed	0	0
1619518929.792126 IsDebuggerPresent		failed	0	0
1619518929.792126 IsDebuggerPresent		failed	0	0
1619518931.729374 IsDebuggerPresent		failed	0	0
1619518931.729374 IsDebuggerPresent		failed	0	0
1619518932.135374 IsDebuggerPresent		failed	0	0
1619518932.135374 IsDebuggerPresent		failed	0	0
1619518937.448249 IsDebuggerPresent		failed	0	0
1619518937.464249 IsDebuggerPresent		failed	0	0
1619518950.214751 IsDebuggerPresent		failed	0	0
1619518950.214751 IsDebuggerPresent		failed	0	0
1619518950.354751 IsDebuggerPresent		failed	0	0
1619518950.354751 IsDebuggerPresent		failed	0	0
1619518953.823374 IsDebuggerPresent		failed	0	0
1619518953.823374 IsDebuggerPresent		failed	0	0
1619518955.776126 IsDebuggerPresent		failed	0	0
1619518955.776126 IsDebuggerPresent		failed	0	0
1619518956.245126 IsDebuggerPresent		failed	0	0
1619518956.245126 IsDebuggerPresent		failed	0	0
1619518961.573374 IsDebuggerPresent		failed	0	0
1619518961.573374 IsDebuggerPresent		failed	0	0

Command line console output was observed (25 个事件)

Time & API	Arguments	Status	Return
1619518903.089751 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518903.104751 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518900.667001 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518910.901126 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518910.917126 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518909.948751 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518917.542499 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518917.573499 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518916.417501 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518924.667876 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518924.682876 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518923.932876 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518932.370374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518932.385374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518931.526626 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518938.964626 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518938.979626 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518938.182501 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518955.557626 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518955.557626 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518954.667626 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518961.995001 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe console_handle: 0x00000007	success	1
1619518962.026001 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619518960.807374 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619518971.464876 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513302.967008 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 369 个事件)

Time & API	Arguments	Status
1619513302.232008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00380000	success
1619513302.232008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00430000	success
1619513302.638008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00520000	success
1619513302.638008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00630000	success
1619513302.795008 NtProtectVirtualMemory	process_identifier: 912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619513302.935008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00520000	success
1619513302.935008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a0000	success
1619513302.935008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success
1619513302.935008 NtProtectVirtualMemory	process_identifier: 912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619513302.935008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1619513303.123008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1619513303.201008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00415000	success
1619513303.201008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041b000	success
1619513303.201008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success
1619513303.310008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success
1619513303.357008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fc000	success
1619513303.420008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f0000	success
1619513303.467008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success
1619513303.498008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1619513303.498008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success
1619513303.529008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f4000	success
1619513303.717008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f5000	success
1619513303.826008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f1000	success
1619513305.013008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00620000	success
1619513307.013008 NtAllocateVirtualMemory	process_identifier: 912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f2000	success
1619518895.667001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00460000	success
1619518895.667001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00510000	success
1619518895.698001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00680000	success
1619518895.698001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00720000	success
1619518895.714001 NtProtectVirtualMemory	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619518895.729001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00460000	success
1619518895.729001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c0000	success
1619518895.729001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success
1619518895.729001 NtProtectVirtualMemory	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619518895.729001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success
1619518895.729001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success
1619518895.760001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d5000	success
1619518895.760001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003db000	success
1619518895.760001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d7000	success
1619518895.776001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b3000	success
1619518896.260001 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00721000	success
1619518899.557001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00720000	success
1619518899.557001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a0000	success
1619518899.635001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success
1619518899.635001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022d0000	success
1619518899.635001 NtProtectVirtualMemory	process_identifier: 3100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619518899.682001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00610000	success
1619518899.682001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00650000	success
1619518899.682001 NtAllocateVirtualMemory	process_identifier: 3100 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success
1619518899.682001 NtProtectVirtualMemory	process_identifier: 3100 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success

Creates a suspicious process (2 个事件)

cmdline	cmd.exe /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe"

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe

A process created a hidden window (9 个事件)

Time & API	Arguments	Status	Return
1619513306.763008 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518903.151001 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518911.839126 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518919.229501 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518926.042751 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518932.182126 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518950.245249 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518956.385374 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619518964.964374 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.1786269428828815

section

{'size_of_data': '0x0005a800', 'virtual_address': '0x00002000', 'entropy': 7.1786269428828815, 'name': '.text', 'virtual_size': '0x0005a6e4'}

description

A section with a high entropy has been found

entropy

0.6785379568884724

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (9 个事件)

Time & API	Arguments	Status	Return
1619513306.904008 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518903.167001 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518912.010126 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518919.292501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518926.089751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518932.245126 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518950.276249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518956.417374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619518965.010374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Terminates another process (16 个事件)

Time & API	Arguments	Status
1619518903.510001 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000378	failed
1619518903.510001 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000378	success
1619518912.260126 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000390	failed
1619518912.260126 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000390	success
1619518920.229501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000038c	failed
1619518920.229501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000038c	success
1619518926.448751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000380	failed
1619518926.448751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000380	success
1619518932.526126 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000384	failed
1619518932.526126 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000384	success
1619518950.385249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000848	failed
1619518950.385249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000848	success
1619518956.760374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000037c	failed
1619518956.760374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000037c	success
1619518965.292374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003d4	failed
1619518965.292374 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003d4	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	cmd.exe /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (9 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\None	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5cb7e53c311ab379969ab1cb9bef97c3.exe

Manipulates memory of a non-child process indicative of process injection (50 out of 220 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3432 manipulating memory of non-child process 3516
Process injection	Process 3432 manipulating memory of non-child process 3552
Process injection	Process 3824 manipulating memory of non-child process 3940
Process injection	Process 4068 manipulating memory of non-child process 2256
Process injection	Process 4068 manipulating memory of non-child process 3176
Process injection	Process 4068 manipulating memory of non-child process 1324
Process injection	Process 4068 manipulating memory of non-child process 3352
Process injection	Process 4068 manipulating memory of non-child process 2940
Process injection	Process 4068 manipulating memory of non-child process 1812
Process injection	Process 4068 manipulating memory of non-child process 3480
Process injection	Process 4068 manipulating memory of non-child process 3676
Process injection	Process 4068 manipulating memory of non-child process 3740
Process injection	Process 4068 manipulating memory of non-child process 3792
Process injection	Process 4068 manipulating memory of non-child process 3852
Process injection	Process 4068 manipulating memory of non-child process 3936
Process injection	Process 4068 manipulating memory of non-child process 3904
Process injection	Process 4068 manipulating memory of non-child process 1832
Process injection	Process 4068 manipulating memory of non-child process 4016
Process injection	Process 4068 manipulating memory of non-child process 3416
Process injection	Process 4068 manipulating memory of non-child process 2860
Process injection	Process 4068 manipulating memory of non-child process 2856
Process injection	Process 4068 manipulating memory of non-child process 3976
Process injection	Process 4068 manipulating memory of non-child process 3164
Process injection	Process 4068 manipulating memory of non-child process 3336
Process injection	Process 4068 manipulating memory of non-child process 2968
1619518910.214126 NtAllocateVirtualMemory	process_identifier: 3516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000214 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518910.651126 NtAllocateVirtualMemory	process_identifier: 3552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518918.745501 NtAllocateVirtualMemory	process_identifier: 3940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000214 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518939.167249 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000214 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518939.370249 NtAllocateVirtualMemory	process_identifier: 3176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619518939.651249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000234 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518939.932249 NtAllocateVirtualMemory	process_identifier: 3352 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000240 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518940.135249 NtAllocateVirtualMemory	process_identifier: 2940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000024c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518940.276249 NtAllocateVirtualMemory	process_identifier: 1812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000258 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518940.417249 NtAllocateVirtualMemory	process_identifier: 3480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000264 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518940.589249 NtAllocateVirtualMemory	process_identifier: 3676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000270 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518940.714249 NtAllocateVirtualMemory	process_identifier: 3740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000027c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619518940.839249 NtAllocateVirtualMemory	process_identifier: 3792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000288 allocation_type: 4096 (MEM_COMMIT) base_address: 0x001e0000	success	0	0
1619518940.964249 NtAllocateVirtualMemory	process_identifier: 3852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000294 allocation_type: 4096 (MEM_COMMIT) base_address: 0x001a0000	success	0	0
1619518941.042249 NtAllocateVirtualMemory	process_identifier: 3936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002a0 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619518941.182249 NtAllocateVirtualMemory	process_identifier: 3904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002ac allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518941.323249 NtAllocateVirtualMemory	process_identifier: 1832 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002b8 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518941.464249 NtAllocateVirtualMemory	process_identifier: 4016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002c4 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518941.573249 NtAllocateVirtualMemory	process_identifier: 3416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002d0 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518941.745249 NtAllocateVirtualMemory	process_identifier: 2860 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002dc allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619518941.854249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002e8 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518941.964249 NtAllocateVirtualMemory	process_identifier: 3976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000002f4 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518942.104249 NtAllocateVirtualMemory	process_identifier: 3164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000300 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518942.245249 NtAllocateVirtualMemory	process_identifier: 3336 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000030c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619518942.354249 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000318 allocation_type: 4096 (MEM_COMMIT) base_address: 0x001a0000	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\None:Zone.Identifier

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.33789248
FireEye	Generic.mg.5cb7e53c311ab379
McAfee	GenericRXKJ-XA!5CB7E53C311A
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056081c1 )
Alibaba	TrojanPSW:MSIL/FormBook.3d4272ca
K7GW	Trojan ( 0056081c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2039540
Cyren	W32/MSIL_Kryptik.AQB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.33789248
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Agensla.i!c
Rising	Trojan.GenKryptik!8.AA55 (TFE:C:xImGxY3lXKH)
Ad-Aware	Trojan.GenericKD.33789248
Sophos	Mal/Generic-S + Troj/HawkEy-II
Comodo	Malware@#2j4n90xkymton
F-Secure	Heuristic.HEUR/AGEN.1116674
DrWeb	Trojan.KillProc2.10224
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
Emsisoft	Trojan.GenericKD.33789248 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.PSW.MSIL.aepz
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1116674
Microsoft	Trojan:Win32/FormBook.BY!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.33789248
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4087164
BitDefenderTheta	Gen:NN.ZemsilF.34700.HmW@aeW92ski
ALYac	Trojan.GenericKD.33789248
MAX	malware (ai score=82)
VBA32	TScope.Trojan.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.WBY
Tencent	Malware.Win32.Gencirc.1168ee66
Yandex	Trojan.GenKryptik!kCigEP4zpLE
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.VCR!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.c311ab
Panda	Trj/GdSda.A
Qihoo-360	Win32/Trojan.fc8

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-01 23:45:32

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.