12.2
0-day
61 个模型检测该样本为恶意！
重新分析
更多

6dcdb6d07ab170263e6b46641863ab1611e79d88967ce376e709f02c42c95cdb

5ff183f24747b056676ad3f9874d42a7.exe

分析耗时

78s

最近分析

文件大小

690.0KB
静态报毒 动态报毒 100% ACEG AI SCORE=81 CLOUD COMET CONFIDENCE DARKCOMET DARKKOMET DGNEPN ELDORADO FLYSTUDIO FYNLOS FYNLOSK FYNLOSKI GRAFTOR GRAYBIRD HIGH CONFIDENCE HWUBPDAA JORIK LBP5 MALICIOUS PE PONTOEB R + TROJ R33420 REGISTRYDISABLER RK0@AG1HAAKS SCORE STATIC AI TORDEV UNSAFE XAB@4OF2BC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Backdoor:Win32/DarkKomet.3dc4ce7a 20190527 0.3.0.5
Baidu Win32.Backdoor.Agent.l 20190318 1.0.0.2
Avast MSIL:GenMalicious-CHX [Trj] 20210207 21.1.5827.0
Kingsoft 20210208 2017.9.26.565
McAfee Generic BackDoor.xa 20210208 6.0.6.653
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
静态指标
Command line console output was observed (2 个事件)
Time & API Arguments Status Return Repeated
1619536388.616125
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619536388.616
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619513306.669176
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .itext
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619513306.919176
__exception__
stacktrace: 
5ff183f24747b056676ad3f9874d42a7+0x9772 @ 0x409772
5ff183f24747b056676ad3f9874d42a7+0x8fef1 @ 0x48fef1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1637628
registers.ebp: 1637708
registers.edx: 0
registers.ebx: 4229120
registers.esi: 1637784
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain frozory.hopto.org
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1619513306.450176
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f40000
success 0 0
1619536388.382
NtAllocateVirtualMemory
process_identifier: 3284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004d0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
A process attempted to delay the analysis task. (1 个事件)
description msdcsc.exe tried to sleep 178 seconds, actually delayed analysis time by 178 seconds
Creates a suspicious process (4 个事件)
cmdline cmd.exe /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
cmdline cmd.exe /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
A process created a hidden window (3 个事件)
Time & API Arguments Status Return Repeated
1619513307.247176
ShellExecuteExW
parameters: /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619513307.294176
ShellExecuteExW
parameters: /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619536389.038
CreateProcessInternalW
thread_identifier: 3356
thread_handle: 0x00000248
process_identifier: 3352
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x0000024c
inherit_handles: 0
success 1 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (20 个事件)
Time & API Arguments Status Return Repeated
1619513306.684176
LookupPrivilegeValueW
system_name:
privilege_name: SeSecurityPrivilege
success 1 0
1619513306.684176
LookupPrivilegeValueW
system_name:
privilege_name: SeTakeOwnershipPrivilege
success 1 0
1619513306.684176
LookupPrivilegeValueW
system_name:
privilege_name: SeLoadDriverPrivilege
success 1 0
1619513306.700176
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
1619513306.700176
LookupPrivilegeValueW
system_name:
privilege_name: SeRestorePrivilege
success 1 0
1619513306.716176
LookupPrivilegeValueW
system_name:
privilege_name: SeShutdownPrivilege
success 1 0
1619513306.716176
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619513306.716176
LookupPrivilegeValueW
system_name:
privilege_name: SeRemoteShutdownPrivilege
success 1 0
1619513306.716176
LookupPrivilegeValueW
system_name:
privilege_name: SeManageVolumePrivilege
success 1 0
1619513306.716176
LookupPrivilegeValueW
system_name:
privilege_name: SeCreateGlobalPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeSecurityPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeTakeOwnershipPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeLoadDriverPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeRestorePrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeShutdownPrivilege
success 1 0
1619536388.632
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619536388.648
LookupPrivilegeValueW
system_name:
privilege_name: SeRemoteShutdownPrivilege
success 1 0
1619536388.648
LookupPrivilegeValueW
system_name:
privilege_name: SeManageVolumePrivilege
success 1 0
1619536388.648
LookupPrivilegeValueW
system_name:
privilege_name: SeCreateGlobalPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (8 个事件)
cmdline attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
cmdline cmd.exe /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
cmdline "C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe"
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
cmdline cmd.exe /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
cmdline attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
cmdline C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (19 个事件)
Time & API Arguments Status Return Repeated
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00110000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00120000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00130000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00140000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00150000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00160000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00170000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001c0000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001d0000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001e0000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001f0000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00200000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00210000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00220000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00230000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00010000
success 0 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00020000
success 0 0
Installs itself for autorun at Windows startup (9 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit reg_value C:\Windows\system32\userinit.exe,C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
Creates known Fynloski/DarkComet files, registry keys and/or mutexes (5 个事件)
mutex DC_MUTEX-EYHDRQ0
mutex DCPERSFWBP
regkey HKEY_CURRENT_USER\Software\DC3_FEXEC
regkey HKEY_CURRENT_USER\Software\DC2_USERS
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
Potential code injection by writing to the memory of another process (19 个事件)
Time & API Arguments Status Return Repeated
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: kernel32.dll
process_handle: 0x0000024c
base_address: 0x000f0000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: user32.dll
process_handle: 0x0000024c
base_address: 0x00100000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: Sleep
process_handle: 0x0000024c
base_address: 0x00110000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: MessageBoxA
process_handle: 0x0000024c
base_address: 0x00120000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CreateProcessA
process_handle: 0x0000024c
base_address: 0x00130000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: GetLastError
process_handle: 0x0000024c
base_address: 0x00140000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: SetLastError
process_handle: 0x0000024c
base_address: 0x00150000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CreateMutexA
process_handle: 0x0000024c
base_address: 0x00160000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CloseHandle
process_handle: 0x0000024c
base_address: 0x00170000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: ExitThread
process_handle: 0x0000024c
base_address: 0x001c0000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: OpenProcess
process_handle: 0x0000024c
base_address: 0x001d0000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: DCPERSFWBP
process_handle: 0x0000024c
base_address: 0x001e0000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: TerminateProcess
process_handle: 0x0000024c
base_address: 0x001f0000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: GetExitCodeProcess
process_handle: 0x0000024c
base_address: 0x00200000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: DC_MUTEX-EYHDRQ0
process_handle: 0x0000024c
base_address: 0x00210000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: WaitForSingleObject
process_handle: 0x0000024c
base_address: 0x00220000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
process_handle: 0x0000024c
base_address: 0x00230000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: ×I5v"5vý_wÿ5vÀ5vr5v65v©5v˜ÕØw†5vØ6v5vM6vkL5v"! #
process_handle: 0x0000024c
base_address: 0x00010000
success 1 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: U‹ìƒÄ¬SVW‹]‹C@P‹C8PÿPÿS‰C ‹CDP‹C<PÿPÿS‰C‹CTP‹C8PÿPÿS‰C‹CXP‹C8PÿPÿS‰C‹CHP‹C8PÿPÿS‰C‹CLP‹C8PÿPÿS‰C‹CPP‹C8PÿPÿS‰C4‹C`P‹C8PÿPÿS‰C,‹ClP‹C8PÿPÿS‰C(‹ChP‹C8PÿPÿS‰C0‹CdP‹C8PÿPÿS‰C ‹CpP‹C8PÿPÿS‰C$jÿS‹CxPjjÿS4ÿS=·u$‹C|PjjÿS$‹ø…ÿtVWÿS0VWÿS(WÿS,jÿS jÿS‹C\PjjÿS4‹øÿS=·tRWÿS,ÇE¼DE¬PE¼Pjjjjjj‹CtPjÿS…Àt3öhȋE¬PÿSƒèsƒÎÿ…ötèë¼hÐÿS ë²WÿS,hôÿS ë„_^[‹å]U‹ìÄ ÿÿÿSVW‰Mô‰Uø‰Eü‹Eüè3gýÿ‹Eøè+gýÿ‹Eôè#gýÿµtÿÿÿ3ÀUháõBdÿ0d‰ …0ÿÿÿ3ɺDè%HýÿDž0ÿÿÿDDž\ÿÿÿfDž`ÿÿÿ‹Eüè`¯ýÿ„Àu EüºøõBèÃbýÿ‹EøèG¯ýÿ„Àu Uø3Àèÿýÿ¿öB… ÿÿÿP…0ÿÿÿPjjhjjj‹Eüè—fýÿPjèS†ýÿ‹ ÿÿÿº öB‹Ãè±÷ÿÿ‰F8ºöB‹Ãè¢÷ÿÿ‰F<º(öB‹Ãè“÷ÿÿ‰F@º0öB‹Ãè„÷ÿÿ‰FDº<öB‹Ãèu÷ÿÿ‰FTºLöB‹Ãèf÷ÿÿ‰FHº\öB‹ÃèW÷ÿÿ‰FLºlöB‹ÃèH÷ÿÿ‰FPº|öB‹Ãè9÷ÿÿ‰F`ºˆöB‹Ãè*÷ÿÿ‰Fdº”öB‹Ãè÷ÿÿ‰Fp‹×‹Ãè÷ÿÿ‰Fxº öB‹Ãè÷ÿÿ‰Flº´öB‹Ãèñöÿÿ‰Fh‹Eôè²eýÿ‹Ð‹ÃèÝöÿÿ‰F\ºÈöB‹ÃèÎöÿÿ‰FX‹Eøèeýÿ‹Ð‹Ãèºöÿÿ‰Ft‹…(ÿÿÿ‰F|hÜöBhìöB藆ýÿP虆ýÿ‰høöBhìöB耆ýÿP肆ýÿ‰Fh(öBhìöBèh†ýÿPèj†ýÿ‰F h0öBh÷BèP†ýÿPèR†ýÿ‰Fh|öBhìöBè8†ýÿPè:†ýÿ‰F,h<öBhìöBè †ýÿPè"†ýÿ‰FhLöBhìöBè†ýÿPè †ýÿ‰Fh\öBhìöBèð…ýÿPèò…ýÿ‰FhlöBhìöBè؅ýÿPèڅýÿ‰F4h´öBhìöBèÀ…ýÿPè…ýÿ‰F0hˆöBhìöB訅ýÿP誅ýÿ‰F h öBhìöB萅ýÿP蒅ýÿ‰F(hÈöBhìöBèx…ýÿPèz…ýÿ‰Fh”öBhìöBè`…ýÿPèb…ýÿ‰F$h€j‹ÎºàðB‹Ãèöÿÿ3ÀZYYd‰hèõBEôºèt_ýÿÃ
process_handle: 0x0000024c
base_address: 0x00020000
success 1 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1619536389.069
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x00478968
module_address: 0x00400000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 262467 0
Modifies security center warnings (2 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
Stops Windows services (1 个事件)
service wscsvc (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start)
Disables Windows Security features (4 个事件)
description attempts to disable antivirus notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
description attempts to disable windows update notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
description attempts to disable windows firewall registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall
description attempts to disable firewall notifications registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications
Executed a process and injected code into it, probably while unpacking (47 个事件)
Time & API Arguments Status Return Repeated
1619513306.684176
NtResumeThread
thread_handle: 0x00000170
suspend_count: 1
process_identifier: 2344
success 0 0
1619513307.247176
CreateProcessInternalW
thread_identifier: 1912
thread_handle: 0x0000028c
process_identifier: 912
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x000002c8
inherit_handles: 0
success 1 0
1619513307.294176
CreateProcessInternalW
thread_identifier: 1564
thread_handle: 0x0000028c
process_identifier: 2984
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x000002a0
inherit_handles: 0
success 1 0
1619513308.497176
CreateProcessInternalW
thread_identifier: 3288
thread_handle: 0x00000428
process_identifier: 3284
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000434
inherit_handles: 0
success 1 0
1619536387.038125
CreateProcessInternalW
thread_identifier: 3096
thread_handle: 0x00000080
process_identifier: 3092
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\attrib.exe
track: 1
command_line: attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5ff183f24747b056676ad3f9874d42a7.exe" +s +h
filepath_r: C:\Windows\system32\attrib.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000084
inherit_handles: 1
success 1 0
1619536387.101
CreateProcessInternalW
thread_identifier: 3120
thread_handle: 0x00000080
process_identifier: 3116
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\attrib.exe
track: 1
command_line: attrib "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp" +s +h
filepath_r: C:\Windows\system32\attrib.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000084
inherit_handles: 1
success 1 0
1619536388.538
NtResumeThread
thread_handle: 0x00000174
suspend_count: 1
process_identifier: 3284
success 0 0
1619536389.038
CreateProcessInternalW
thread_identifier: 3356
thread_handle: 0x00000248
process_identifier: 3352
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x0000024c
inherit_handles: 0
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: kernel32.dll
process_handle: 0x0000024c
base_address: 0x000f0000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: user32.dll
process_handle: 0x0000024c
base_address: 0x00100000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00110000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: Sleep
process_handle: 0x0000024c
base_address: 0x00110000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00120000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: MessageBoxA
process_handle: 0x0000024c
base_address: 0x00120000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00130000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CreateProcessA
process_handle: 0x0000024c
base_address: 0x00130000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00140000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: GetLastError
process_handle: 0x0000024c
base_address: 0x00140000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00150000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: SetLastError
process_handle: 0x0000024c
base_address: 0x00150000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00160000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CreateMutexA
process_handle: 0x0000024c
base_address: 0x00160000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00170000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: CloseHandle
process_handle: 0x0000024c
base_address: 0x00170000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001c0000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: ExitThread
process_handle: 0x0000024c
base_address: 0x001c0000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001d0000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: OpenProcess
process_handle: 0x0000024c
base_address: 0x001d0000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001e0000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: DCPERSFWBP
process_handle: 0x0000024c
base_address: 0x001e0000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x001f0000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: TerminateProcess
process_handle: 0x0000024c
base_address: 0x001f0000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00200000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: GetExitCodeProcess
process_handle: 0x0000024c
base_address: 0x00200000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00210000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: DC_MUTEX-EYHDRQ0
process_handle: 0x0000024c
base_address: 0x00210000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00220000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: WaitForSingleObject
process_handle: 0x0000024c
base_address: 0x00220000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00230000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: C:\Users\Administrator.Oskar-PC\AppData\Roaming\MSDCSC\msdcsc.exe
process_handle: 0x0000024c
base_address: 0x00230000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00010000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: ×I5v"5vý_wÿ5vÀ5vr5v65v©5v˜ÕØw†5vØ6v5vM6vkL5v"! #
process_handle: 0x0000024c
base_address: 0x00010000
success 1 0
1619536389.038
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000024c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00020000
success 0 0
1619536389.038
WriteProcessMemory
process_identifier: 3352
buffer: U‹ìƒÄ¬SVW‹]‹C@P‹C8PÿPÿS‰C ‹CDP‹C<PÿPÿS‰C‹CTP‹C8PÿPÿS‰C‹CXP‹C8PÿPÿS‰C‹CHP‹C8PÿPÿS‰C‹CLP‹C8PÿPÿS‰C‹CPP‹C8PÿPÿS‰C4‹C`P‹C8PÿPÿS‰C,‹ClP‹C8PÿPÿS‰C(‹ChP‹C8PÿPÿS‰C0‹CdP‹C8PÿPÿS‰C ‹CpP‹C8PÿPÿS‰C$jÿS‹CxPjjÿS4ÿS=·u$‹C|PjjÿS$‹ø…ÿtVWÿS0VWÿS(WÿS,jÿS jÿS‹C\PjjÿS4‹øÿS=·tRWÿS,ÇE¼DE¬PE¼Pjjjjjj‹CtPjÿS…Àt3öhȋE¬PÿSƒèsƒÎÿ…ötèë¼hÐÿS ë²WÿS,hôÿS ë„_^[‹å]U‹ìÄ ÿÿÿSVW‰Mô‰Uø‰Eü‹Eüè3gýÿ‹Eøè+gýÿ‹Eôè#gýÿµtÿÿÿ3ÀUháõBdÿ0d‰ …0ÿÿÿ3ɺDè%HýÿDž0ÿÿÿDDž\ÿÿÿfDž`ÿÿÿ‹Eüè`¯ýÿ„Àu EüºøõBèÃbýÿ‹EøèG¯ýÿ„Àu Uø3Àèÿýÿ¿öB… ÿÿÿP…0ÿÿÿPjjhjjj‹Eüè—fýÿPjèS†ýÿ‹ ÿÿÿº öB‹Ãè±÷ÿÿ‰F8ºöB‹Ãè¢÷ÿÿ‰F<º(öB‹Ãè“÷ÿÿ‰F@º0öB‹Ãè„÷ÿÿ‰FDº<öB‹Ãèu÷ÿÿ‰FTºLöB‹Ãèf÷ÿÿ‰FHº\öB‹ÃèW÷ÿÿ‰FLºlöB‹ÃèH÷ÿÿ‰FPº|öB‹Ãè9÷ÿÿ‰F`ºˆöB‹Ãè*÷ÿÿ‰Fdº”öB‹Ãè÷ÿÿ‰Fp‹×‹Ãè÷ÿÿ‰Fxº öB‹Ãè÷ÿÿ‰Flº´öB‹Ãèñöÿÿ‰Fh‹Eôè²eýÿ‹Ð‹ÃèÝöÿÿ‰F\ºÈöB‹ÃèÎöÿÿ‰FX‹Eøèeýÿ‹Ð‹Ãèºöÿÿ‰Ft‹…(ÿÿÿ‰F|hÜöBhìöB藆ýÿP虆ýÿ‰høöBhìöB耆ýÿP肆ýÿ‰Fh(öBhìöBèh†ýÿPèj†ýÿ‰F h0öBh÷BèP†ýÿPèR†ýÿ‰Fh|öBhìöBè8†ýÿPè:†ýÿ‰F,h<öBhìöBè †ýÿPè"†ýÿ‰FhLöBhìöBè†ýÿPè †ýÿ‰Fh\öBhìöBèð…ýÿPèò…ýÿ‰FhlöBhìöBè؅ýÿPèڅýÿ‰F4h´öBhìöBèÀ…ýÿPè…ýÿ‰F0hˆöBhìöB訅ýÿP誅ýÿ‰F h öBhìöB萅ýÿP蒅ýÿ‰F(hÈöBhìöBèx…ýÿPèz…ýÿ‰Fh”öBhìöBè`…ýÿPèb…ýÿ‰F$h€j‹ÎºàðB‹Ãèöÿÿ3ÀZYYd‰hèõBEôºèt_ýÿÃ
process_handle: 0x0000024c
base_address: 0x00020000
success 1 0
1619536389.054
NtResumeThread
thread_handle: 0x0000025c
suspend_count: 1
process_identifier: 3284
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Trojan.RegistryDisabler.RK0@aG1HaAkS
FireEye Generic.mg.5ff183f24747b056
CAT-QuickHeal Backdoor.Fynloski.A9
ALYac Gen:Trojan.RegistryDisabler.RK0@aG1HaAkS
Cylance Unsafe
Zillya Backdoor.DarkKomet.Win32.30209
SUPERAntiSpyware Trojan.Agent/Gen-Graftor
Sangfor Win.Trojan.DarkKomet-1
K7AntiVirus Trojan ( 004bc4d11 )
Alibaba Backdoor:Win32/DarkKomet.3dc4ce7a
K7GW Trojan ( 004bc4d11 )
Cybereason malicious.24747b
BitDefenderTheta AI:Packer.36941FD21C
Cyren W32/Downloader.C.gen!Eldorado
Symantec SMG.Heur!gen
TotalDefense Win32/Fynloski.A!generic
Baidu Win32.Backdoor.Agent.l
APEX Malicious
Avast MSIL:GenMalicious-CHX [Trj]
Cynet Malicious (score: 100)
Kaspersky Backdoor.Win32.DarkKomet.aceg
BitDefender Gen:Trojan.RegistryDisabler.RK0@aG1HaAkS
NANO-Antivirus Trojan.Win32.Tordev.dgnepn
Paloalto generic.ml
AegisLab Trojan.Win32.DarkKomet.lBP5
Ad-Aware Gen:Trojan.RegistryDisabler.RK0@aG1HaAkS
Sophos Mal/Generic-R + Troj/Fynlosk-AK
Comodo Backdoor.Win32.Agent.XAB@4of2bc
DrWeb BackDoor.Tordev.9
VIPRE Backdoor.Win32.Fynloski.A (v)
TrendMicro BKDR_FYNLOS.SMM
McAfee-GW-Edition BehavesLike.Win32.Backdoor.jh
Emsisoft Gen:Trojan.RegistryDisabler.RK0@aG1HaAkS (B)
SentinelOne Static AI - Malicious PE - Spyware
Jiangmin Backdoor/DarkKomet.lue
Webroot W32.Trojan.Gen
Avira BDS/Backdoor.Gen
Antiy-AVL Trojan[Backdoor]/Win32.DarkKomet
Microsoft Backdoor:Win32/Fynloski
Gridinsoft Trojan.Win32.FlyStudio.vl!i
ViRobot Backdoor.Win32.DarkComet.675328
ZoneAlarm Backdoor.Win32.DarkKomet.aceg
GData Win32.Trojan-Spy.DarkComet.J
AhnLab-V3 Backdoor/Win32.Graybird.R33420
Acronis suspicious
McAfee Generic BackDoor.xa
MAX malware (ai score=81)
VBA32 Backdoor.Tordev
Malwarebytes DarkComet.Backdoor.RAT.DDS
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-06-08 19:12:27

Imports

Library oleaut32.dll:
• 0x49dca4 SysFreeString
• 0x49dca8 SysReAllocStringLen
• 0x49dcac SysAllocStringLen
Library advapi32.dll:
• 0x49dcb4 RegQueryValueExA
• 0x49dcb8 RegOpenKeyExA
• 0x49dcbc RegCloseKey
Library user32.dll:
• 0x49dcc4 GetKeyboardType
• 0x49dcc8 DestroyWindow
• 0x49dccc LoadStringA
• 0x49dcd0 MessageBoxA
• 0x49dcd4 CharNextA
Library kernel32.dll:
• 0x49dcdc GetACP
• 0x49dce0 Sleep
• 0x49dce4 VirtualFree
• 0x49dce8 VirtualAlloc
• 0x49dcec GetTickCount
• 0x49dcf4 GetCurrentThreadId
• 0x49dd00 VirtualQuery
• 0x49dd04 WideCharToMultiByte
• 0x49dd08 MultiByteToWideChar
• 0x49dd0c lstrlenA
• 0x49dd10 lstrcpynA
• 0x49dd14 LoadLibraryExA
• 0x49dd18 GetThreadLocale
• 0x49dd1c GetStartupInfoA
• 0x49dd20 GetProcAddress
• 0x49dd24 GetModuleHandleA
• 0x49dd28 GetModuleFileNameA
• 0x49dd2c GetLocaleInfoA
• 0x49dd30 GetLastError
• 0x49dd34 GetCommandLineA
• 0x49dd38 FreeLibrary
• 0x49dd3c FindFirstFileA
• 0x49dd40 FindClose
• 0x49dd44 ExitProcess
• 0x49dd48 ExitThread
• 0x49dd4c CreateThread
• 0x49dd50 CompareStringA
• 0x49dd54 WriteFile
• 0x49dd5c SetFilePointer
• 0x49dd60 SetEndOfFile
• 0x49dd64 RtlUnwind
• 0x49dd68 ReadFile
• 0x49dd6c RaiseException
• 0x49dd70 GetStdHandle
• 0x49dd74 GetFileSize
• 0x49dd78 GetFileType
• 0x49dd7c CreateFileA
• 0x49dd80 CloseHandle
Library kernel32.dll:
• 0x49dd88 TlsSetValue
• 0x49dd8c TlsGetValue
• 0x49dd90 LocalAlloc
• 0x49dd94 GetModuleHandleA
Library user32.dll:
• 0x49dd9c CreateWindowExA
• 0x49dda0 mouse_event
• 0x49dda4 keybd_event
• 0x49dda8 WindowFromPoint
• 0x49ddac WaitMessage
• 0x49ddb0 VkKeyScanA
• 0x49ddb4 UpdateWindow
• 0x49ddb8 UnregisterClassA
• 0x49ddbc UnhookWindowsHookEx
• 0x49ddc0 TranslateMessage
• 0x49ddc8 TrackPopupMenu
• 0x49ddcc ToAscii
• 0x49ddd4 ShowWindow
• 0x49ddd8 ShowScrollBar
• 0x49dddc ShowOwnedPopups
• 0x49dde0 SetWindowsHookExA
• 0x49dde4 SetWindowTextA
• 0x49dde8 SetWindowPos
• 0x49ddec SetWindowPlacement
• 0x49ddf0 SetWindowLongW
• 0x49ddf4 SetWindowLongA
• 0x49ddf8 SetTimer
• 0x49ddfc SetScrollRange
• 0x49de00 SetScrollPos
• 0x49de04 SetScrollInfo
• 0x49de08 SetRect
• 0x49de0c SetPropA
• 0x49de10 SetParent
• 0x49de14 SetMenuItemInfoA
• 0x49de18 SetMenu
• 0x49de1c SetForegroundWindow
• 0x49de20 SetFocus
• 0x49de24 SetCursorPos
• 0x49de28 SetCursor
• 0x49de2c SetClipboardData
• 0x49de30 SetClassLongA
• 0x49de34 SetCapture
• 0x49de38 SetActiveWindow
• 0x49de3c SendMessageW
• 0x49de40 SendMessageA
• 0x49de44 ScrollWindow
• 0x49de48 ScreenToClient
• 0x49de4c RemovePropA
• 0x49de50 RemoveMenu
• 0x49de54 ReleaseDC
• 0x49de58 ReleaseCapture
• 0x49de64 RegisterClassA
• 0x49de68 RedrawWindow
• 0x49de6c PtInRect
• 0x49de70 PostQuitMessage
• 0x49de74 PostMessageA
• 0x49de78 PeekMessageW
• 0x49de7c PeekMessageA
• 0x49de80 OpenClipboard
• 0x49de84 OffsetRect
• 0x49de88 OemToCharA
• 0x49de94 MessageBoxA
• 0x49de98 MapWindowPoints
• 0x49de9c MapVirtualKeyA
• 0x49dea0 LockWorkStation
• 0x49dea4 LoadStringA
• 0x49dea8 LoadKeyboardLayoutA
• 0x49deac LoadIconA
• 0x49deb0 LoadCursorA
• 0x49deb4 LoadBitmapA
• 0x49deb8 KillTimer
• 0x49debc IsZoomed
• 0x49dec0 IsWindowVisible
• 0x49dec4 IsWindowUnicode
• 0x49dec8 IsWindowEnabled
• 0x49decc IsWindow
• 0x49ded0 IsRectEmpty
• 0x49ded4 IsIconic
• 0x49ded8 IsDialogMessageW
• 0x49dedc IsDialogMessageA
• 0x49dee4 IsChild
• 0x49dee8 InvalidateRect
• 0x49deec IntersectRect
• 0x49def0 InsertMenuItemA
• 0x49def4 InsertMenuA
• 0x49def8 InflateRect
• 0x49df04 GetWindowTextA
• 0x49df08 GetWindowRect
• 0x49df0c GetWindowPlacement
• 0x49df10 GetWindowLongW
• 0x49df14 GetWindowLongA
• 0x49df18 GetWindowDC
• 0x49df1c GetTopWindow
• 0x49df20 GetSystemMetrics
• 0x49df24 GetSystemMenu
• 0x49df28 GetSysColorBrush
• 0x49df2c GetSysColor
• 0x49df30 GetSubMenu
• 0x49df34 GetScrollRange
• 0x49df38 GetScrollPos
• 0x49df3c GetScrollInfo
• 0x49df40 GetPropA
• 0x49df44 GetParent
• 0x49df48 GetWindow
• 0x49df4c GetMessagePos
• 0x49df50 GetMessageA
• 0x49df54 GetMenuStringA
• 0x49df58 GetMenuState
• 0x49df5c GetMenuItemInfoA
• 0x49df60 GetMenuItemID
• 0x49df64 GetMenuItemCount
• 0x49df68 GetMenu
• 0x49df6c GetLastInputInfo
• 0x49df70 GetLastActivePopup
• 0x49df74 GetKeyboardState
• 0x49df80 GetKeyboardLayout
• 0x49df84 GetKeyState
• 0x49df88 GetKeyNameTextA
• 0x49df8c GetIconInfo
• 0x49df90 GetForegroundWindow
• 0x49df94 GetFocus
• 0x49df98 GetDesktopWindow
• 0x49df9c GetDCEx
• 0x49dfa0 GetDC
• 0x49dfa4 GetCursorPos
• 0x49dfa8 GetCursor
• 0x49dfac GetClipboardData
• 0x49dfb0 GetClientRect
• 0x49dfb4 GetClassNameA
• 0x49dfb8 GetClassLongA
• 0x49dfbc GetClassInfoA
• 0x49dfc0 GetCapture
• 0x49dfc4 GetActiveWindow
• 0x49dfc8 FrameRect
• 0x49dfcc FindWindowExA
• 0x49dfd0 FindWindowA
• 0x49dfd4 FillRect
• 0x49dfd8 ExitWindowsEx
• 0x49dfdc EqualRect
• 0x49dfe0 EnumWindows
• 0x49dfe4 EnumThreadWindows
• 0x49dfe8 EnumDisplayDevicesA
• 0x49dff0 EnumChildWindows
• 0x49dff4 EndPaint
• 0x49dff8 EnableWindow
• 0x49dffc EnableScrollBar
• 0x49e000 EnableMenuItem
• 0x49e004 EmptyClipboard
• 0x49e008 DrawTextA
• 0x49e00c DrawMenuBar
• 0x49e010 DrawIconEx
• 0x49e014 DrawIcon
• 0x49e018 DrawFrameControl
• 0x49e01c DrawEdge
• 0x49e020 DispatchMessageW
• 0x49e024 DispatchMessageA
• 0x49e028 DestroyWindow
• 0x49e02c DestroyMenu
• 0x49e030 DestroyIcon
• 0x49e034 DestroyCursor
• 0x49e038 DeleteMenu
• 0x49e03c DefWindowProcA
• 0x49e040 DefMDIChildProcA
• 0x49e044 DefFrameProcA
• 0x49e048 CreatePopupMenu
• 0x49e04c CreateMenu
• 0x49e050 CreateIcon
• 0x49e054 CloseClipboard
• 0x49e058 ClientToScreen
• 0x49e05c CheckMenuItem
• 0x49e060 CallWindowProcA
• 0x49e064 CallNextHookEx
• 0x49e068 BeginPaint
• 0x49e06c CharNextA
• 0x49e070 CharLowerBuffA
• 0x49e074 CharLowerA
• 0x49e078 CharUpperBuffA
• 0x49e07c CharToOemA
• 0x49e080 AdjustWindowRectEx
Library gdi32.dll:
• 0x49e08c UnrealizeObject
• 0x49e090 StretchBlt
• 0x49e094 SetWindowOrgEx
• 0x49e098 SetWinMetaFileBits
• 0x49e09c SetViewportOrgEx
• 0x49e0a0 SetTextColor
• 0x49e0a4 SetStretchBltMode
• 0x49e0a8 SetROP2
• 0x49e0ac SetPixel
• 0x49e0b0 SetEnhMetaFileBits
• 0x49e0b4 SetDIBColorTable
• 0x49e0b8 SetBrushOrgEx
• 0x49e0bc SetBkMode
• 0x49e0c0 SetBkColor
• 0x49e0c4 SelectPalette
• 0x49e0c8 SelectObject
• 0x49e0cc SaveDC
• 0x49e0d0 RestoreDC
• 0x49e0d4 RectVisible
• 0x49e0d8 RealizePalette
• 0x49e0dc PlayEnhMetaFile
• 0x49e0e0 PatBlt
• 0x49e0e4 MoveToEx
• 0x49e0e8 MaskBlt
• 0x49e0ec LineTo
• 0x49e0f0 IntersectClipRect
• 0x49e0f4 GetWindowOrgEx
• 0x49e0f8 GetWinMetaFileBits
• 0x49e0fc GetTextMetricsA
• 0x49e108 GetStockObject
• 0x49e10c GetRgnBox
• 0x49e110 GetPixel
• 0x49e114 GetPaletteEntries
• 0x49e118 GetObjectA
• 0x49e124 GetEnhMetaFileBits
• 0x49e128 GetDeviceCaps
• 0x49e12c GetDIBits
• 0x49e130 GetDIBColorTable
• 0x49e134 GetDCOrgEx
• 0x49e13c GetClipBox
• 0x49e140 GetBrushOrgEx
• 0x49e144 GetBitmapBits
• 0x49e148 GdiFlush
• 0x49e14c ExtTextOutA
• 0x49e150 ExcludeClipRect
• 0x49e154 DeleteObject
• 0x49e158 DeleteEnhMetaFile
• 0x49e15c DeleteDC
• 0x49e160 CreateSolidBrush
• 0x49e164 CreatePenIndirect
• 0x49e168 CreatePalette
• 0x49e170 CreateFontIndirectA
• 0x49e174 CreateDIBitmap
• 0x49e178 CreateDIBSection
• 0x49e17c CreateDCA
• 0x49e180 CreateCompatibleDC
• 0x49e188 CreateBrushIndirect
• 0x49e18c CreateBitmap
• 0x49e190 CopyEnhMetaFileA
• 0x49e194 BitBlt
Library version.dll:
• 0x49e19c VerQueryValueA
• 0x49e1a4 GetFileVersionInfoA
Library kernel32.dll:
• 0x49e1ac lstrcpyA
• 0x49e1b0 WriteProcessMemory
• 0x49e1b4 WriteFile
• 0x49e1b8 WinExec
• 0x49e1bc WaitForSingleObject
• 0x49e1c4 VirtualQuery
• 0x49e1c8 VirtualProtectEx
• 0x49e1cc VirtualProtect
• 0x49e1d0 VirtualFreeEx
• 0x49e1d4 VirtualFree
• 0x49e1d8 VirtualAllocEx
• 0x49e1dc VirtualAlloc
• 0x49e1e0 VerLanguageNameA
• 0x49e1e4 UnmapViewOfFile
• 0x49e1e8 TerminateProcess
• 0x49e1ec Sleep
• 0x49e1f0 SizeofResource
• 0x49e1f4 SetThreadPriority
• 0x49e1f8 SetThreadLocale
• 0x49e1fc SetThreadContext
• 0x49e200 SetLastError
• 0x49e204 SetFileTime
• 0x49e208 SetFilePointer
• 0x49e20c SetFileAttributesA
• 0x49e210 SetEvent
• 0x49e214 SetErrorMode
• 0x49e218 SetEndOfFile
• 0x49e21c ResumeThread
• 0x49e220 ResetEvent
• 0x49e224 ReadProcessMemory
• 0x49e228 ReadFile
• 0x49e22c PeekNamedPipe
• 0x49e230 OpenProcess
• 0x49e234 MultiByteToWideChar
• 0x49e238 MulDiv
• 0x49e23c MoveFileA
• 0x49e240 MapViewOfFile
• 0x49e244 LockResource
• 0x49e24c LocalAlloc
• 0x49e250 LoadResource
• 0x49e254 LoadLibraryA
• 0x49e25c IsBadReadPtr
• 0x49e264 HeapFree
• 0x49e268 HeapAlloc
• 0x49e26c GlobalUnlock
• 0x49e270 GlobalMemoryStatus
• 0x49e274 GlobalLock
• 0x49e278 GlobalFree
• 0x49e27c GlobalFindAtomA
• 0x49e280 GlobalDeleteAtom
• 0x49e284 GlobalAlloc
• 0x49e288 GlobalAddAtomA
• 0x49e294 GetVersionExA
• 0x49e298 GetVersion
• 0x49e2a0 GetTickCount
• 0x49e2a4 GetThreadLocale
• 0x49e2a8 GetThreadContext
• 0x49e2ac GetTempPathA
• 0x49e2b4 GetSystemDirectoryA
• 0x49e2b8 GetStdHandle
• 0x49e2bc GetProcessHeap
• 0x49e2c0 GetProcAddress
• 0x49e2c4 GetModuleHandleA
• 0x49e2c8 GetModuleFileNameA
• 0x49e2cc GetLocaleInfoA
• 0x49e2d0 GetLocalTime
• 0x49e2d4 GetLastError
• 0x49e2d8 GetFullPathNameA
• 0x49e2dc GetFileTime
• 0x49e2e0 GetFileSize
• 0x49e2e4 GetFileAttributesA
• 0x49e2e8 GetExitCodeThread
• 0x49e2ec GetExitCodeProcess
• 0x49e2f4 GetDriveTypeA
• 0x49e2f8 GetDiskFreeSpaceA
• 0x49e2fc GetDateFormatA
• 0x49e300 GetCurrentThreadId
• 0x49e304 GetCurrentThread
• 0x49e308 GetCurrentProcessId
• 0x49e30c GetCurrentProcess
• 0x49e310 GetComputerNameA
• 0x49e314 GetCPInfo
• 0x49e318 FreeResource
• 0x49e320 InterlockedExchange
• 0x49e328 FreeLibrary
• 0x49e32c FormatMessageA
• 0x49e330 FindResourceA
• 0x49e334 FindNextFileA
• 0x49e338 FindFirstFileA
• 0x49e33c FindClose
• 0x49e34c ExitThread
• 0x49e350 ExitProcess
• 0x49e354 EnumResourceNamesA
• 0x49e358 EnumCalendarInfoA
• 0x49e364 DeleteFileA
• 0x49e36c CreateThread
• 0x49e370 CreateRemoteThread
• 0x49e374 CreateProcessA
• 0x49e378 CreatePipe
• 0x49e37c CreateMutexA
• 0x49e380 CreateFileMappingA
• 0x49e384 CreateFileA
• 0x49e388 CreateEventA
• 0x49e38c CreateDirectoryA
• 0x49e390 CopyFileA
• 0x49e394 CompareStringA
• 0x49e398 CloseHandle
• 0x49e39c Beep
Library advapi32.dll:
• 0x49e3a4 RegSetValueExA
• 0x49e3a8 RegQueryValueExA
• 0x49e3ac RegQueryInfoKeyA
• 0x49e3b0 RegOpenKeyExA
• 0x49e3b4 RegOpenKeyA
• 0x49e3b8 RegFlushKey
• 0x49e3bc RegEnumValueA
• 0x49e3c0 RegEnumKeyExA
• 0x49e3c4 RegDeleteValueA
• 0x49e3c8 RegDeleteKeyA
• 0x49e3cc RegCreateKeyExA
• 0x49e3d0 RegCreateKeyA
• 0x49e3d4 RegCloseKey
• 0x49e3d8 OpenThreadToken
• 0x49e3dc OpenProcessToken
• 0x49e3ec LookupAccountSidA
• 0x49e3f0 IsValidSid
• 0x49e3f4 GetUserNameA
• 0x49e3f8 GetTokenInformation
• 0x49e400 GetSidSubAuthority
Library oleaut32.dll:
• 0x49e414 GetErrorInfo
• 0x49e418 GetActiveObject
• 0x49e41c SysFreeString
Library ole32.dll:
• 0x49e424 CoTaskMemFree
• 0x49e428 CLSIDFromProgID
• 0x49e42c ProgIDFromCLSID
• 0x49e430 StringFromCLSID
• 0x49e434 CoCreateInstance
• 0x49e438 CoUninitialize
• 0x49e43c CoInitialize
• 0x49e440 IsEqualGUID
Library kernel32.dll:
• 0x49e448 Sleep
Library ole32.dll:
• 0x49e450 CoTaskMemFree
• 0x49e454 StringFromCLSID
Library oleaut32.dll:
• 0x49e45c SafeArrayPtrOfIndex
• 0x49e460 SafeArrayGetUBound
• 0x49e464 SafeArrayGetLBound
• 0x49e468 SafeArrayCreate
• 0x49e46c VariantChangeType
• 0x49e470 VariantCopy
• 0x49e474 VariantClear
• 0x49e478 VariantInit
Library netapi32.dll:
• 0x49e480 Netbios
Library shell32.dll:
• 0x49e488 ShellExecuteExA
• 0x49e48c ShellExecuteA
• 0x49e490 SHGetFileInfoA
• 0x49e494 SHFileOperationA
• 0x49e498 DragQueryFileA
Library gdiplus.dll:
• 0x49e4a8 GdipDrawImageRectI
• 0x49e4b0 GdipDeleteGraphics
• 0x49e4c8 GdipDisposeImage
• 0x49e4cc GdiplusShutdown
• 0x49e4d0 GdiplusStartup
• 0x49e4d4 GdipFree
• 0x49e4d8 GdipAlloc
Library winmm.dll:
• 0x49e4e4 waveInStart
• 0x49e4e8 waveInReset
• 0x49e4ec waveInPrepareHeader
• 0x49e4f0 waveInOpen
• 0x49e4f4 waveInClose
• 0x49e4f8 waveInAddBuffer
• 0x49e4fc PlaySoundA
• 0x49e500 mciSendStringA
Library URLMON.DLL:
• 0x49e508 URLDownloadToFileA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.