5.6
高危
60 个模型检测该样本为恶意！
重新分析
更多

3d8bc67bb77836ec4d9e2ab1e32a825aad31b5367fe2aa82d50fd6175ce3932f

645bd2f0395cee91794c7d0e3e81a815.exe

分析耗时

86s

最近分析

文件大小

744.5KB
静态报毒 动态报毒 100% 9QUHTLO AI SCORE=84 AIDETECTVM BANKERX CLASSIC CONFIDENCE ELJF EMOTET ENCPK ERHS GENCIRC GENETIC GENKRYPTIK HDMT HIGH CONFIDENCE HMIAKF INJECT3 KFEO KRYPTIK MALICIOUS PE MALWARE1 MALWARE@#3ELQJAPXB5O7M PINKSBOT QAKBOT QBOT R + MAL RAZY SCORE SMTHA STATIC AI SUSGEN TROJANBANKER UM0@AGCP@9OI UNSAFE YNTGR ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanBanker:Win32/Qakbot.b75a4b61 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20201210 21.1.5827.0
McAfee W32/PinkSbot-GS!645BD2F0395C 20201211 6.0.6.653
Tencent Malware.Win32.Gencirc.10cdcb5f 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619610607.89025
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619625314.592499
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (4 个事件)
resource name IMAGE
resource name MUI
resource name UIFILE
resource name WEVT_TEMPLATE
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619625315.405499
__exception__
stacktrace: 
645bd2f0395cee91794c7d0e3e81a815+0x3f07 @ 0x403f07
645bd2f0395cee91794c7d0e3e81a815+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3034216
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 645bd2f0395cee91794c7d0e3e81a815+0x3449
exception.instruction: in eax, dx
exception.module: 645bd2f0395cee91794c7d0e3e81a815.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
1619625315.405499
__exception__
stacktrace: 
645bd2f0395cee91794c7d0e3e81a815+0x3f10 @ 0x403f10
645bd2f0395cee91794c7d0e3e81a815+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3034216
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: 645bd2f0395cee91794c7d0e3e81a815+0x34e2
exception.instruction: in eax, dx
exception.module: 645bd2f0395cee91794c7d0e3e81a815.exe
exception.exception_code: 0xc0000096
exception.offset: 13538
exception.address: 0x4034e2
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619610606.87525
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02040000
success 0 0
1619610607.67125
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02080000
success 0 0
1619610607.67125
NtProtectVirtualMemory
process_identifier: 2144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619625314.342499
NtAllocateVirtualMemory
process_identifier: 2116
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00580000
success 0 0
1619625314.577499
NtAllocateVirtualMemory
process_identifier: 2116
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005d0000
success 0 0
1619625314.577499
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619610612.01525
CreateProcessInternalW
thread_identifier: 2620
thread_handle: 0x0000014c
process_identifier: 2116
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\645bd2f0395cee91794c7d0e3e81a815.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
Expresses interest in specific running processes (1 个事件)
process vboxservice.exe
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619625315.405499
__exception__
stacktrace: 
645bd2f0395cee91794c7d0e3e81a815+0x3f07 @ 0x403f07
645bd2f0395cee91794c7d0e3e81a815+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 3034216
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 645bd2f0395cee91794c7d0e3e81a815+0x3449
exception.instruction: in eax, dx
exception.module: 645bd2f0395cee91794c7d0e3e81a815.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.ERHS
FireEye Generic.mg.645bd2f0395cee91
Qihoo-360 Win32/Trojan.BO.849
ALYac Trojan.Agent.QakBot
Cylance Unsafe
Zillya Trojan.Qbot.Win32.8222
Sangfor Malware
K7AntiVirus Trojan ( 005673a11 )
Alibaba TrojanBanker:Win32/Qakbot.b75a4b61
K7GW Trojan ( 005673a11 )
Cybereason malicious.189c73
Arcabit Trojan.Agent.ERHS
Cyren W32/Trojan.KFEO-7539
Symantec Packed.Generic.459
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Razy-8019799-0
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.pef
BitDefender Trojan.Agent.ERHS
NANO-Antivirus Trojan.Win32.Inject3.hmiakf
AegisLab Trojan.Win32.Qbot.7!c
Avast Win32:BankerX-gen [Trj]
Rising Trojan.Kryptik!1.C6C9 (CLASSIC)
Ad-Aware Trojan.Agent.ERHS
TACHYON Trojan/W32.Agent.762368.DQ
Emsisoft Trojan.Agent.ERHS (B)
Comodo Malware@#3elqjapxb5o7m
F-Secure Trojan.TR/AD.Qbot.yntgr
DrWeb Trojan.Inject3.40354
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.QAKBOT.SMTHA.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.bh
Sophos Mal/Generic-R + Mal/EncPk-APV
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Zenpak.bsq
Avira TR/AD.Qbot.yntgr
Antiy-AVL Trojan[Banker]/Win32.Qbot
Microsoft Trojan:Win32/Qakbot.AR!MTB
ViRobot Trojan.Win32.S.QakBot.762368
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.pef
GData Trojan.Agent.ERHS
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.Generic.C4105164
McAfee W32/PinkSbot-GS!645BD2F0395C
MAX malware (ai score=84)
VBA32 TrojanBanker.Qbot
Malwarebytes Backdoor.Qbot
ESET-NOD32 a variant of Win32/Kryptik.HDMT
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-22 01:36:47

Imports

Library KERNEL32.dll:
• 0x496904 GetDriveTypeA
• 0x496908 GetTickCount
• 0x49690c GetLocalTime
• 0x496910 WriteFile
• 0x496918 SetFilePointer
• 0x49691c ReadFile
• 0x496920 MoveFileExA
• 0x496924 CopyFileA
• 0x496930 GetLongPathNameA
• 0x496934 GlobalAlloc
• 0x496938 GlobalFree
• 0x49693c SetFileAttributesA
• 0x496940 DeleteFileA
• 0x496944 GetSystemTime
• 0x496948 GetComputerNameA
• 0x49694c CreateDirectoryA
• 0x496954 FindFirstFileA
• 0x496958 FindNextFileA
• 0x49695c FindClose
• 0x496960 GetLastError
• 0x496968 ResetEvent
• 0x49696c SetEvent
• 0x496970 CreateEventA
• 0x496984 WaitForSingleObject
• 0x496988 GetModuleHandleA
• 0x496994 LocalFree
• 0x496998 FormatMessageA
• 0x49699c GetFileType
• 0x4969a0 FlushFileBuffers
• 0x4969a4 GlobalDeleteAtom
• 0x4969a8 GlobalUnlock
• 0x4969ac GlobalLock
• 0x4969b0 MultiByteToWideChar
• 0x4969b8 DeleteAtom
• 0x4969bc GetCurrentThreadId
• 0x4969c0 AddAtomA
• 0x4969c4 RtlUnwind
• 0x4969c8 RaiseException
• 0x4969cc HeapFree
• 0x4969d0 HeapReAlloc
• 0x4969d4 HeapAlloc
• 0x4969d8 ExitThread
• 0x4969dc CreateThread
• 0x4969e0 GetStartupInfoA
• 0x4969e4 GetCommandLineA
• 0x4969e8 ExitProcess
• 0x4969ec WideCharToMultiByte
• 0x4969f0 TlsAlloc
• 0x4969f4 SetLastError
• 0x4969f8 TlsFree
• 0x4969fc TlsSetValue
• 0x496a00 TlsGetValue
• 0x496a04 GetACP
• 0x496a08 GetOEMCP
• 0x496a0c GetCPInfo
• 0x496a10 LCMapStringA
• 0x496a14 LCMapStringW
• 0x496a1c HeapDestroy
• 0x496a20 HeapCreate
• 0x496a24 VirtualFree
• 0x496a28 VirtualAlloc
• 0x496a2c IsBadWritePtr
• 0x496a34 HeapSize
• 0x496a38 GetStdHandle
• 0x496a4c SetHandleCount
• 0x496a50 CompareStringA
• 0x496a54 CompareStringW
• 0x496a58 GetStringTypeA
• 0x496a5c GetStringTypeW
• 0x496a60 IsBadReadPtr
• 0x496a64 IsBadCodePtr
• 0x496a68 GetLocaleInfoA
• 0x496a6c VirtualProtect
• 0x496a70 GetSystemInfo
• 0x496a74 InterlockedExchange
• 0x496a78 SetStdHandle
• 0x496a80 GetLongPathNameW
• 0x496a84 Sleep
• 0x496a8c GetStartupInfoW
• 0x496a90 CopyFileW
• 0x496a94 GetCurrentProcessId
• 0x496a9c TerminateProcess
• 0x496aa0 GetCurrentProcess
• 0x496aa4 IsDebuggerPresent
• 0x496aa8 GetModuleFileNameW
• 0x496aac CreateDirectoryW
• 0x496ab0 CloseHandle
• 0x496ab4 LoadLibraryA
• 0x496ab8 GetProcAddress
• 0x496abc GetModuleHandleW
Library USER32.dll:
• 0x496ac4 GetDC
• 0x496ac8 SetDeskWallpaper
• 0x496ad4 LoadIconA
• 0x496ad8 LoadCursorFromFileW
• 0x496adc CharNextA
Library COMDLG32.dll:
• 0x496ae4 GetFileTitleW
Library ADVAPI32.dll:
• 0x496aec RegCloseKey
• 0x496af0 RegOpenKeyA
• 0x496af4 RegQueryValueExA
Library SHELL32.dll:
• 0x496afc DragFinish
Library SHLWAPI.dll:
• 0x496b04 PathIsUNCW
Library IMM32.dll:
• 0x496b0c ImmGetContext

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.