SmartHawk

7.8

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

51b758ec870caeca167e24b4e7da08a9628a99ac033823420d3e6ea204ec8e2c

5eda5883dc925b61fb5dd03a86037930.exe

分析耗时

81s

最近分析

文件大小

432.0KB

静态报毒动态报毒 AGENTTESLA AI SCORE=88 ATTRIBUTE CLOUD CONFIDENCE ELDORADO EPLL FAREIT GDSDA GENERICKD GENKRYPTIK GRDWJ HIGH CONFIDENCE HIGHCONFIDENCE HPXSSD KRYPTIK MALICIOUS PE MASSLOGGER PWSX QBCP R002C0DH220 R346697 SCORE SIGGEN9 TAZI TSCOPE UNCLASSIFIEDMALWARE@0 UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXO!5EDA5883DC92	20200817	6.0.6.653
Alibaba	Trojan:MSIL/AgentTesla.c959aa78	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0
Avast	Win32:PWSX-gen [Trj]	20200817	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200817	2013.8.14.323
Tencent	Msil.Trojan.Crypt.Tazi	20200817	1.0.0.1

Checks if process is being debugged by a debugger (36 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513301.449176 IsDebuggerPresent		failed	0	0
1619513301.449176 IsDebuggerPresent		failed	0	0
1619513351.309176 IsDebuggerPresent		failed	0	0
1619513351.809176 IsDebuggerPresent		failed	0	0
1619513352.324176 IsDebuggerPresent		failed	0	0
1619513352.809176 IsDebuggerPresent		failed	0	0
1619513353.324176 IsDebuggerPresent		failed	0	0
1619513353.809176 IsDebuggerPresent		failed	0	0
1619513354.324176 IsDebuggerPresent		failed	0	0
1619513354.809176 IsDebuggerPresent		failed	0	0
1619513355.324176 IsDebuggerPresent		failed	0	0
1619513355.809176 IsDebuggerPresent		failed	0	0
1619513356.324176 IsDebuggerPresent		failed	0	0
1619513356.809176 IsDebuggerPresent		failed	0	0
1619513357.324176 IsDebuggerPresent		failed	0	0
1619513357.809176 IsDebuggerPresent		failed	0	0
1619513358.324176 IsDebuggerPresent		failed	0	0
1619513358.809176 IsDebuggerPresent		failed	0	0
1619513359.324176 IsDebuggerPresent		failed	0	0
1619513359.809176 IsDebuggerPresent		failed	0	0
1619513360.324176 IsDebuggerPresent		failed	0	0
1619513360.809176 IsDebuggerPresent		failed	0	0
1619513361.324176 IsDebuggerPresent		failed	0	0
1619513361.809176 IsDebuggerPresent		failed	0	0
1619513362.324176 IsDebuggerPresent		failed	0	0
1619513362.809176 IsDebuggerPresent		failed	0	0
1619513363.324176 IsDebuggerPresent		failed	0	0
1619513363.824176 IsDebuggerPresent		failed	0	0
1619513364.324176 IsDebuggerPresent		failed	0	0
1619513364.824176 IsDebuggerPresent		failed	0	0
1619513365.324176 IsDebuggerPresent		failed	0	0
1619513365.824176 IsDebuggerPresent		failed	0	0
1619513366.324176 IsDebuggerPresent		failed	0	0
1619513366.824176 IsDebuggerPresent		failed	0	0
1619514712.009374 IsDebuggerPresent		failed	0	0
1619514712.009374 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513301.496176 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 107 个事件)

Time & API	Arguments	Status	Return
1619513300.809176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006c0000	success	0
1619513300.809176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007a0000	success	0
1619513301.152176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00c90000	success	0
1619513301.152176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00de0000	success	0
1619513301.293176 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1619513301.449176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00e20000	success	0
1619513301.449176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f60000	success	0
1619513301.449176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051a000	success	0
1619513301.449176 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1619513301.449176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00512000	success	0
1619513301.777176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00522000	success	0
1619513301.949176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00545000	success	0
1619513301.949176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054b000	success	0
1619513301.949176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success	0
1619513302.027176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00523000	success	0
1619513302.043176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052c000	success	0
1619513302.418176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00524000	success	0
1619513302.434176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00526000	success	0
1619513302.512176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00750000	success	0
1619513302.606176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00527000	success	0
1619513302.637176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success	0
1619513302.637176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success	0
1619513302.824176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00751000	success	0
1619513303.121176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success	0
1619513303.121176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success	0
1619513303.293176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00528000	success	0
1619513303.309176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00529000	success	0
1619513303.496176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dd0000	success	0
1619513303.574176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dd1000	success	0
1619513303.590176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00752000	success	0
1619513303.637176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00753000	success	0
1619513303.652176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00756000	success	0
1619513303.652176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dd2000	success	0
1619513344.668176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00de1000	success	0
1619513344.746176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00757000	success	0
1619513344.871176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051c000	success	0
1619513344.887176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00758000	success	0
1619513344.949176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dd3000	success	0
1619513344.949176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052d000	success	0
1619513344.965176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00759000	success	0
1619513345.059176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075a000	success	0
1619513345.074176 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 289280 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04c00400	failed	3221225550
1619513350.606176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dd4000	success	0
1619513350.606176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075b000	success	0
1619513350.668176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075c000	success	0
1619513350.684176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075d000	success	0
1619513350.777176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075e000	success	0
1619513350.777176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0075f000	success	0
1619513351.152176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05aa0000	success	0
1619513351.152176 NtAllocateVirtualMemory	process_identifier: 368 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05aa1000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.914695493042997

section

{'size_of_data': '0x0006b400', 'virtual_address': '0x00002000', 'entropy': 7.914695493042997, 'name': '.text', 'virtual_size': '0x0006b228'}

description

A section with a high entropy has been found

entropy

0.9942062572421785

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513345.059176 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (3 个事件)

host	104.84.236.147
host	172.67.83.132
host	172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513366.777176 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00007f40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619513366.777176 WriteProcessMemory	process_identifier: 2236 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELõæ^àPo @ À@ÈnS H.text$O P `.rsrcR@@.reloc V@B process_handle: 0x00007f40 base_address: 0x00400000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: 0HX´´4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoð000004b0,FileDescription 0FileVersion0.0.0.0p'InternalNameBXHvLEuvRzUddWnqWCBodkcWAIecsSUmSj.exe(LegalCopyright x'OriginalFilenameBXHvLEuvRzUddWnqWCBodkcWAIecsSUmSj.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00007f40 base_address: 0x00448000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: ` ? process_handle: 0x00007f40 base_address: 0x0044a000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: @ process_handle: 0x00007f40 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513366.777176 WriteProcessMemory	process_identifier: 2236 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELõæ^àPo @ À@ÈnS H.text$O P `.rsrcR@@.reloc V@B process_handle: 0x00007f40 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 368 called NtSetContextThread to modify thread in remote process 2236
1619513366.809176 NtSetContextThread	thread_handle: 0x0000dc90 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484894 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2236	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 368 resumed a thread in remote process 2236
1619513367.246176 NtResumeThread	thread_handle: 0x0000dc90 suspend_count: 1 process_identifier: 2236	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619513301.449176 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 368	success	0
1619513301.465176 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 368	success	0
1619513301.512176 NtResumeThread	thread_handle: 0x00000174 suspend_count: 1 process_identifier: 368	success	0
1619513351.277176 NtResumeThread	thread_handle: 0x000092f4 suspend_count: 1 process_identifier: 368	success	0
1619513351.293176 NtResumeThread	thread_handle: 0x000066b0 suspend_count: 1 process_identifier: 368	success	0
1619513366.762176 CreateProcessInternalW	thread_identifier: 2864 thread_handle: 0x0000dc90 process_identifier: 2236 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5eda5883dc925b61fb5dd03a86037930.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5eda5883dc925b61fb5dd03a86037930.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00007f40 inherit_handles: 0	success	1
1619513366.777176 NtGetContextThread	thread_handle: 0x0000dc90	success	0
1619513366.777176 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00007f40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619513366.777176 WriteProcessMemory	process_identifier: 2236 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELõæ^àPo @ À@ÈnS H.text$O P `.rsrcR@@.reloc V@B process_handle: 0x00007f40 base_address: 0x00400000	success	1
1619513366.777176 WriteProcessMemory	process_identifier: 2236 buffer: process_handle: 0x00007f40 base_address: 0x00402000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: 0HX´´4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoð000004b0,FileDescription 0FileVersion0.0.0.0p'InternalNameBXHvLEuvRzUddWnqWCBodkcWAIecsSUmSj.exe(LegalCopyright x'OriginalFilenameBXHvLEuvRzUddWnqWCBodkcWAIecsSUmSj.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00007f40 base_address: 0x00448000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: ` ? process_handle: 0x00007f40 base_address: 0x0044a000	success	1
1619513366.793176 WriteProcessMemory	process_identifier: 2236 buffer: @ process_handle: 0x00007f40 base_address: 0x7efde008	success	1
1619513366.809176 NtSetContextThread	thread_handle: 0x0000dc90 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484894 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2236	success	0
1619513367.246176 NtResumeThread	thread_handle: 0x0000dc90 suspend_count: 1 process_identifier: 2236	success	0
1619513367.246176 NtResumeThread	thread_handle: 0x00007978 suspend_count: 1 process_identifier: 368	success	0
1619514712.009374 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2236	success	0
1619514712.009374 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2236	success	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen9.48175
MicroWorld-eScan	Trojan.GenericKD.34267096
FireEye	Generic.mg.5eda5883dc925b61
CAT-QuickHeal	Trojan.MSIL
McAfee	Fareit-FXO!5EDA5883DC92
Malwarebytes	Trojan.MalPack
Sangfor	Malware
K7AntiVirus	Trojan ( 0056bb1d1 )
Alibaba	Trojan:MSIL/AgentTesla.c959aa78
K7GW	Trojan ( 0056bb1d1 )
CrowdStrike	win/malicious_confidence_80% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.XEQ
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
GData	Trojan.GenericKD.34267096
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34267096
NANO-Antivirus	Trojan.Win32.Crypt.hpxssd
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Crypt.4!c
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ad-Aware	Trojan.GenericKD.34267096
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Kryptik.grdwj
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DH220
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/MSIL_Kryptik.BGS.gen!Eldorado
Jiangmin	Trojan.MSIL.qbcp
Avira	TR/Kryptik.grdwj
MAX	malware (ai score=88)
Antiy-AVL	Trojan/MSIL.Crypt
Arcabit	Trojan.Generic.D20ADFD8
ViRobot	Trojan.Win32.Z.Kryptik.442368.EQ
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Kryptik.R346697
VBA32	TScope.Trojan.MSIL
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0DH220
Tencent	Msil.Trojan.Crypt.Tazi
Ikarus	Trojan-Spy.MassLogger
eGambit	Unsafe.AI_Score_85%
Fortinet	MSIL/GenKryptik.EPLL!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-31 20:31:58

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
104.84.236.147	443	192.168.56.101	49172
172.67.83.132	443	192.168.56.101	49179

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.