SmartHawk

8.8

极危

50 个模型检测该样本为恶意！

重新分析

下载样本

d2fa978a4013681cb084a7fdc4edad7c3cc6b846a64c39c942ccc1c39dd118ba

5d38fc2367215f3c1b4424ff2a482a1c.exe

分析耗时

27s

最近分析

文件大小

336.0KB

静态报毒动态报毒 AGEN AGENSLA AGENTTESLA AI SCORE=88 ARTEMIS ATTRIBUTE BASIC CONFIDENCE EGUJ ELDORADO GDSDA GENKRYPTIK HHAGKM HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALWARE@#2B0R75DXF3XZR NEGASTEAL SCORE SIGGEN9 SUSGEN SWUY TAJU TROJANX TSCOPE UKQB22BGVFS UNSAFE YAKBEEXMSIL ZAPCHAST 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!5D38FC236721	20201229	6.0.6.653
Alibaba		20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_70% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201229	21.1.5827.0
Kingsoft		20201229	2017.9.26.565
Tencent	Msil.Trojan.Zapchast.Swuy	20201229	1.0.0.1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513302.186895 IsDebuggerPresent		failed	0	0
1619513302.186895 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513302.249895 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 61 个事件)

Time & API	Arguments	Status
1619513301.374895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006c0000	success
1619513301.374895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00760000	success
1619513301.780895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00c90000	success
1619513301.780895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e70000	success
1619513301.921895 NtProtectVirtualMemory	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619513302.186895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ad0000	success
1619513302.186895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b50000	success
1619513302.202895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success
1619513302.202895 NtProtectVirtualMemory	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619513302.202895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00522000	success
1619513302.655895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success
1619513302.811895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00555000	success
1619513302.827895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055b000	success
1619513302.827895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00557000	success
1619513302.905895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00533000	success
1619513302.936895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053c000	success
1619513303.264895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00534000	success
1619513303.264895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success
1619513303.374895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00720000	success
1619513303.452895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success
1619513303.624895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00546000	success
1619513303.655895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00721000	success
1619513303.655895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b51000	success
1619513303.671895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b52000	success
1619513303.671895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b53000	success
1619513303.686895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00538000	success
1619513303.702895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00722000	success
1619513303.702895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b54000	success
1619513303.702895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b55000	success
1619513303.749895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b56000	success
1619513303.749895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b5a000	success
1619513303.749895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success
1619513303.749895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success
1619513303.764895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00723000	success
1619513303.921895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00724000	success
1619513304.296895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success
1619513304.436895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00539000	success
1619513304.639895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c70000	success
1619513304.764895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb0000	success
1619513304.842895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c71000	success
1619513304.889895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c72000	success
1619513304.921895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e71000	success
1619513305.061895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c73000	success
1619513305.092895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c74000	success
1619513305.092895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c75000	success
1619513305.108895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00725000	success
1619513305.108895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b6b000	success
1619513305.108895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b6c000	success
1619513305.108895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b6d000	success
1619513305.108895 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b6e000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.6814470191565

section

{'size_of_data': '0x00053600', 'virtual_address': '0x00002000', 'entropy': 7.6814470191565, 'name': '.text', 'virtual_size': '0x000534f8'}

description

A section with a high entropy has been found

entropy

0.9940387481371088

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513305.405895 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (4 个事件)

Time & API	Arguments	Status
1619513305.733895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2060 process_handle: 0x00000238	failed
1619513305.733895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2060 process_handle: 0x00000238	success
1619513306.014895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000244	failed
1619513306.014895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000244	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (3 个事件)

Time & API	Arguments	Status	Return
1619513305.405895 NtAllocateVirtualMemory	process_identifier: 2060 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000224 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619513305.780895 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000023c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619513306.124895 NtAllocateVirtualMemory	process_identifier: 1564 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000240 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0

Manipulates memory of a non-child process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3004 manipulating memory of non-child process 2060
Process injection	Process 3004 manipulating memory of non-child process 2712
1619513305.405895 NtAllocateVirtualMemory	process_identifier: 2060 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000224 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619513305.780895 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000023c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $wÏEÂ3®+3®+3®+\Øq®+\Øµ0®+\Ø¶2®+Rich3®+PEL&^)Bà 0¶ @ @.textÔ ` process_handle: 0x00000240 base_address: 0x00400000	success	1	0
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: @ process_handle: 0x00000240 base_address: 0x7efde008	success	1	0

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $wÏEÂ3®+3®+3®+\Øq®+\Øµ0®+\Ø¶2®+Rich3®+PEL&^)Bà 0¶ @ @.textÔ ` process_handle: 0x00000240 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3004 called NtSetContextThread to modify thread in remote process 1564
1619513306.139895 NtSetContextThread	thread_handle: 0x00000244 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1564	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3004 resumed a thread in remote process 1564
1619513306.374895 NtResumeThread	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 1564	success	0	0

Executed a process and injected code into it, probably while unpacking (17 个事件)

Time & API	Arguments	Status	Return
1619513302.186895 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 3004	success	0
1619513302.217895 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 3004	success	0
1619513302.311895 NtResumeThread	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 3004	success	0
1619513305.389895 CreateProcessInternalW	thread_identifier: 784 thread_handle: 0x00000220 process_identifier: 2060 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000224 inherit_handles: 0	success	1
1619513305.405895 NtGetContextThread	thread_handle: 0x00000220	success	0
1619513305.405895 NtAllocateVirtualMemory	process_identifier: 2060 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000224 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619513305.780895 CreateProcessInternalW	thread_identifier: 1544 thread_handle: 0x00000238 process_identifier: 2712 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000023c inherit_handles: 0	success	1
1619513305.780895 NtGetContextThread	thread_handle: 0x00000238	success	0
1619513305.780895 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000023c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619513306.124895 CreateProcessInternalW	thread_identifier: 3040 thread_handle: 0x00000244 process_identifier: 1564 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5d38fc2367215f3c1b4424ff2a482a1c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000240 inherit_handles: 0	success	1
1619513306.124895 NtGetContextThread	thread_handle: 0x00000244	success	0
1619513306.124895 NtAllocateVirtualMemory	process_identifier: 1564 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000240 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÈº´ Í!¸LÍ!This program cannot be run in DOS mode. $wÏEÂ3®+3®+3®+\Øq®+\Øµ0®+\Ø¶2®+Rich3®+PEL&^)Bà 0¶ @ @.textÔ ` process_handle: 0x00000240 base_address: 0x00400000	success	1
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: process_handle: 0x00000240 base_address: 0x00401000	success	1
1619513306.139895 WriteProcessMemory	process_identifier: 1564 buffer: @ process_handle: 0x00000240 base_address: 0x7efde008	success	1
1619513306.139895 NtSetContextThread	thread_handle: 0x00000244 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306480 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1564	success	0
1619513306.374895 NtResumeThread	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 1564	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.2.Gen
FireEye	Generic.mg.5d38fc2367215f3c
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Artemis!5D38FC236721
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056860f1 )
K7GW	Trojan ( 0056860f1 )
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.MSIL.Basic.2.Gen
Cyren	W32/MSIL_Kryptik.AKB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Zapchast.gen
BitDefender	Trojan.MSIL.Basic.2.Gen
NANO-Antivirus	Trojan.Win32.Agensla.hhagkm
AegisLab	Trojan.MSIL.Agensla.i!c
Ad-Aware	Trojan.MSIL.Basic.2.Gen
Sophos	Mal/Generic-R
Comodo	Malware@#2b0r75dxf3xzr
F-Secure	Heuristic.HEUR/AGEN.1134071
DrWeb	Trojan.Siggen9.26062
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.MSIL.NEGASTEAL.SMC
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Trojan.MSIL.Basic.2.Gen (B)
Paloalto	generic.ml
Jiangmin	Trojan.MSIL.taju
Avira	HEUR/AGEN.1134071
MAX	malware (ai score=88)
Gridinsoft	Trojan.Win32.Kryptik.dd!n
Microsoft	Trojan:MSIL/AgentTesla
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.MSIL.Basic.2.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Trojanspy.C4059571
ALYac	Spyware.AgentTesla
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.VFJ
TrendMicro-HouseCall	TrojanSpy.MSIL.NEGASTEAL.SMC
Tencent	Msil.Trojan.Zapchast.Swuy
Yandex	Trojan.Kryptik!UkqB22bGVFs
MaxSecure	Trojan.Malware.74499699.susgen
Fortinet	MSIL/GenKryptik.EGUJ!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.367215
Panda	Trj/GdSda.A
Qihoo-360	Generic/Trojan.PSW.374

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-03-25 12:02:13

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.