9.4
极危
50 个模型检测该样本为恶意！
重新分析
更多

7aca0d9eb6cb1de2e08f9524cf6e273a7d6ac94c593c4b93de1c603d41ac1ab3

647614548dc94402b2eec18eaf28940c.exe

分析耗时

85s

最近分析

文件大小

474.0KB
静态报毒 动态报毒 AGENT@0 AI SCORE=82 CLOUD CONFIDENCE ELDORADO GDSDA GENERICKD GENOME HACKTOOL HIGH CONFIDENCE IGENERIC INJECT3 KQWAV KRYPTIK MALICIOUS PE MIMIKATZ NOON R002C0DHH20 RATX SCORE SUSGEN TSCOPE UNSAFE WNWG ZMUTZY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba HackTool:MSIL/Mimikatz.f50ad022 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Avast Win32:RATX-gen [Trj] 20200824 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200825 2013.8.14.323
McAfee RDN/Generic.rp 20200824 6.0.6.653
Tencent Msil.Trojan-spy.Noon.Wnwg 20200825 1.0.0.1
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619613058.011
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619613059.261
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (5 个事件)
Time & API Arguments Status Return Repeated
1619610594.125
IsDebuggerPresent
failed 0 0
1619610594.125
IsDebuggerPresent
failed 0 0
1619610641.485
IsDebuggerPresent
failed 0 0
1619613045.745
IsDebuggerPresent
failed 0 0
1619613045.745
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619610594.156
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 163 个事件)
Time & API Arguments Status Return Repeated
1619610593.156
NtAllocateVirtualMemory
process_identifier: 200
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619610593.156
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00590000
success 0 0
1619610593.969
NtAllocateVirtualMemory
process_identifier: 200
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00c10000
success 0 0
1619610593.969
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d70000
success 0 0
1619610594.016
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619610594.125
NtAllocateVirtualMemory
process_identifier: 200
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00620000
success 0 0
1619610594.125
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006c0000
success 0 0
1619610594.125
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619610594.125
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619610594.125
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1619610594.375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00532000
success 0 0
1619610594.469
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00565000
success 0 0
1619610594.485
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056b000
success 0 0
1619610594.485
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00567000
success 0 0
1619610594.641
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00533000
success 0 0
1619610594.703
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053c000
success 0 0
1619610595.406
NtAllocateVirtualMemory
process_identifier: 200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00534000
success 0 0
1619610595.406
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00536000
success 0 0
1619610595.547
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00740000
success 0 0
1619610595.703
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055a000
success 0 0
1619610595.703
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00557000
success 0 0
1619610596.11
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00556000
success 0 0
1619610596.11
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053a000
success 0 0
1619610596.235
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00741000
success 0 0
1619610596.578
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00537000
success 0 0
1619610596.578
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00538000
success 0 0
1619610596.641
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00539000
success 0 0
1619610638.219
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00742000
success 0 0
1619610638.25
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d71000
success 0 0
1619610638.391
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00743000
success 0 0
1619610638.531
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052c000
success 0 0
1619610638.61
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00744000
success 0 0
1619610638.641
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04f50000
success 0 0
1619610638.656
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00745000
success 0 0
1619610638.797
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04f51000
success 0 0
1619610638.813
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 332800
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05070400
failed 3221225550 0
1619610641.219
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00746000
success 0 0
1619610641.219
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00747000
success 0 0
1619610641.219
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00748000
success 0 0
1619610641.25
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00749000
success 0 0
1619610641.25
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0074a000
success 0 0
1619610641.375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04f52000
success 0 0
1619610641.375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0074b000
success 0 0
1619610641.422
NtAllocateVirtualMemory
process_identifier: 200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0074c000
success 0 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05070178
failed 3221225550 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x050701a0
failed 3221225550 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x050701c8
failed 3221225550 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x050701f0
failed 3221225550 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05070218
failed 3221225550 0
1619610641.438
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 11
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x050c210e
failed 3221225550 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.907163057683871 section {'size_of_data': '0x00075c00', 'virtual_address': '0x00002000', 'entropy': 7.907163057683871, 'name': '.text', 'virtual_size': '0x00075bfc'} description A section with a high entropy has been found
entropy 0.9947201689545935 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619610638.797
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619613057.245
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619610641.563
NtAllocateVirtualMemory
process_identifier: 952
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000f888
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkN1_à  (®G `@  @…`GK`€  H.text´' ( `.rsrc`*@@.reloc €0@B
process_handle: 0x0000f888
base_address: 0x00400000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer:  €P€8€€h€ `„$cê„4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°äStringFileInfoÀ000004b0,FileDescription 0FileVersion0.0.0.0XInternalNameQrPHdzppObdlXgIoUCIZBBb.exe(LegalCopyright `OriginalFilenameQrPHdzppObdlXgIoUCIZBBb.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x0000f888
base_address: 0x00456000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: @ °7
process_handle: 0x0000f888
base_address: 0x00458000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: @
process_handle: 0x0000f888
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkN1_à  (®G `@  @…`GK`€  H.text´' ( `.rsrc`*@@.reloc €0@B
process_handle: 0x0000f888
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 200 called NtSetContextThread to modify thread in remote process 952
Time & API Arguments Status Return Repeated
1619610641.563
NtSetContextThread
thread_handle: 0x0000f0f4
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4540334
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 952
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 200 resumed a thread in remote process 952
Time & API Arguments Status Return Repeated
1619610641.672
NtResumeThread
thread_handle: 0x0000f0f4
suspend_count: 1
process_identifier: 952
success 0 0
Executed a process and injected code into it, probably while unpacking (20 个事件)
Time & API Arguments Status Return Repeated
1619610594.125
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 200
success 0 0
1619610594.141
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 200
success 0 0
1619610594.156
NtResumeThread
thread_handle: 0x0000016c
suspend_count: 1
process_identifier: 200
success 0 0
1619610641.469
NtResumeThread
thread_handle: 0x0000b490
suspend_count: 1
process_identifier: 200
success 0 0
1619610641.485
NtResumeThread
thread_handle: 0x00000e84
suspend_count: 1
process_identifier: 200
success 0 0
1619610641.563
CreateProcessInternalW
thread_identifier: 1244
thread_handle: 0x0000f0f4
process_identifier: 952
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\647614548dc94402b2eec18eaf28940c.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\647614548dc94402b2eec18eaf28940c.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000f888
inherit_handles: 0
success 1 0
1619610641.563
NtGetContextThread
thread_handle: 0x0000f0f4
success 0 0
1619610641.563
NtAllocateVirtualMemory
process_identifier: 952
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000f888
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELkN1_à  (®G `@  @…`GK`€  H.text´' ( `.rsrc`*@@.reloc €0@B
process_handle: 0x0000f888
base_address: 0x00400000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer:
process_handle: 0x0000f888
base_address: 0x00402000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer:  €P€8€€h€ `„$cê„4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°äStringFileInfoÀ000004b0,FileDescription 0FileVersion0.0.0.0XInternalNameQrPHdzppObdlXgIoUCIZBBb.exe(LegalCopyright `OriginalFilenameQrPHdzppObdlXgIoUCIZBBb.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x0000f888
base_address: 0x00456000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: @ °7
process_handle: 0x0000f888
base_address: 0x00458000
success 1 0
1619610641.563
WriteProcessMemory
process_identifier: 952
buffer: @
process_handle: 0x0000f888
base_address: 0x7efde008
success 1 0
1619610641.563
NtSetContextThread
thread_handle: 0x0000f0f4
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4540334
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 952
success 0 0
1619610641.672
NtResumeThread
thread_handle: 0x0000f0f4
suspend_count: 1
process_identifier: 952
success 0 0
1619613045.745
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 952
success 0 0
1619613045.745
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 952
success 0 0
1619613045.745
NtResumeThread
thread_handle: 0x00000170
suspend_count: 1
process_identifier: 952
success 0 0
1619613059.152
NtResumeThread
thread_handle: 0x000002e0
suspend_count: 1
process_identifier: 952
success 0 0
1619613059.183
NtResumeThread
thread_handle: 0x00000310
suspend_count: 1
process_identifier: 952
success 0 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.Inject3.51227
MicroWorld-eScan Trojan.GenericKD.43676394
FireEye Generic.mg.647614548dc94402
CAT-QuickHeal Trojan.IGENERIC
ALYac Trojan.GenericKD.43676394
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056c9be1 )
Alibaba HackTool:MSIL/Mimikatz.f50ad022
K7GW Trojan ( 0056c9be1 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Trojan.Generic.D29A72EA
Invincea heuristic
Cyren W32/MSIL_Kryptik.BKP.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:RATX-gen [Trj]
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender Trojan.GenericKD.43676394
Rising Spyware.Noon!8.E7C9 (CLOUD)
Ad-Aware Trojan.GenericKD.43676394
Comodo TrojWare.Win32.Genome.agent@0
F-Secure Trojan.TR/Kryptik.kqwav
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DHH20
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Inject
MaxSecure Trojan.Malware.300983.susgen
Avira TR/Kryptik.kqwav
MAX malware (ai score=82)
Antiy-AVL Trojan[Spy]/MSIL.Noon
Microsoft HackTool:Win64/Mimikatz.A
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
GData Trojan.GenericKD.43676394
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Win32.RL_Generic.C4182378
McAfee RDN/Generic.rp
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.MalPack.PNG.Generic
ESET-NOD32 a variant of MSIL/Kryptik.XJA
TrendMicro-HouseCall TROJ_GEN.R002C0DHH20
Tencent Msil.Trojan-spy.Noon.Wnwg
SentinelOne DFI - Malicious PE
Fortinet MSIL/Zmutzy.CDE!tr
Webroot W32.Trojan.Gen
AVG Win32:RATX-gen [Trj]
Cybereason malicious.043d82
Panda Trj/GdSda.A
Qihoo-360 Generic/Trojan.Spy.beb
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-17 02:45:30

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 63497 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60215 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51964 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.