16.8
0-day
61 个模型检测该样本为恶意！
重新分析
更多

d57943072f9a41079c95173cb7c1c650afe9262f1db599029eab78ebe19a2d81

6911af2717c7a1c27735fdafdbbb3f76.exe

分析耗时

103s

最近分析

文件大小

1.5MB
静态报毒 动态报毒 100% ADCD@8RNP34 AI SCORE=88 AIDETECTVM AMPM ATTRIBUTE AZ8D6EXO22F AZAT CCW5BSGI+5A CONFIDENCE DARKEYE DXWDRC EN0@AU7E75LG ESWS FYNLOSKI GENASA GENCIRC GENERICR GENETIC HIGH CONFIDENCE HIGHCONFIDENCE KCLOUD MALICIOUS PE MALWARE1 OCCAMY QVM03 R + MAL R066C0DIA20 R335725 RAZY SCORE SEZF SIGGEN STATIC AI SUSGEN TOOL TRMC UNSAFE XJHFH ZAPCHAST ZEVBAF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericR-EPS!6911AF2717C7 20201211 6.0.6.653
Alibaba Trojan:Win32/VBInject.c3f87dc1 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Agent-AZAT [Trj] 20201210 21.1.5827.0
Tencent Malware.Win32.Gencirc.10b7d08d 20201211 1.0.0.1
Kingsoft Win32.Troj.Generic_a.a.(kcloud) 20201211 2017.9.26.565
静态指标
Command line console output was observed (4 个事件)
Time & API Arguments Status Return Repeated
1619632714.971751
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619632714.971751
WriteConsoleW
buffer: REG
console_handle: 0x00000007
success 1 0
1619632714.971751
WriteConsoleW
buffer: ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe" /f
console_handle: 0x00000007
success 1 0
1619632715.331626
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619632718.267999
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619632713.986999
__exception__
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

registers.esp: 1636412
registers.edi: 1636688
registers.eax: 1636412
registers.ebp: 1636492
registers.edx: 0
registers.ebx: 9008784
registers.esi: 1636688
registers.ecx: 2
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Connects to a Dynamic DNS Domain (1 个事件)
domain mrsnickers03.no-ip.biz
Allocates read-write-execute memory (usually to unpack itself) (50 out of 72 个事件)
Time & API Arguments Status Return Repeated
1619632708.409751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c0000
success 0 0
1619632708.409751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005d0000
success 0 0
1619632708.409751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e0000
success 0 0
1619632708.409751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005f0000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00600000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00620000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008c0000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008d0000
success 0 0
1619632708.424751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e0000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f0000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00900000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00910000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026b0000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026c0000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026d0000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02820000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02830000
success 0 0
1619632708.456751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02840000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02850000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02860000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02870000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02880000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02890000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028a0000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028b0000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c0000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ae0000
success 0 0
1619632710.971751
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02af0000
success 0 0
1619632711.049249
NtProtectVirtualMemory
process_identifier: 196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619632711.142999
NtProtectVirtualMemory
process_identifier: 300
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619632764.268501
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000003e70000
success 0 0
1619632717.314999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00600000
success 0 0
1619632717.314999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00620000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00630000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f40000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f50000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f60000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f70000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f80000
success 0 0
1619632717.330999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f90000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fa0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fb0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027a0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027b0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027c0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027d0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027e0000
success 0 0
1619632717.345999
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02800000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (1 个事件)
name RT_VERSION offset 0x001799d0 filetype data sublanguage SUBLANG_ARABIC_MOROCCO size 0x00000380
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Creates a suspicious process (1 个事件)
cmdline C:\Windows\System32\svchost.exe
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619632714.705999
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\GHEMF.bat
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\GHEMF.bat
show_type: 0
success 1 0
1619632716.392999
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1619632705.612751
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00590000
success 0 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (50 个事件)
Time & API Arguments Status Return Repeated
1619632719.159751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632720.659751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632722.159751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632723.659751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632725.174751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632726.674751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632728.174751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632729.674751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632731.174751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632732.690751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632734.190751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632735.690751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632737.190751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632738.706751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632740.221751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632741.721751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632743.221751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632744.721751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632746.221751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632747.721751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632749.221751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632750.737751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632752.237751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632753.752751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632755.252751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632756.768751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632758.284751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632759.799751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632761.299751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632762.799751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632764.299751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632765.799751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632767.315751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632768.815751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632770.315751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632771.815751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632773.315751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632774.815751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632776.315751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632777.815751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632718.298999
LookupPrivilegeValueW
system_name:
privilege_name: SeSecurityPrivilege
success 1 0
1619632718.314999
LookupPrivilegeValueW
system_name:
privilege_name: SeTakeOwnershipPrivilege
success 1 0
1619632718.314999
LookupPrivilegeValueW
system_name:
privilege_name: SeLoadDriverPrivilege
success 1 0
1619632718.330999
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
1619632718.330999
LookupPrivilegeValueW
system_name:
privilege_name: SeRestorePrivilege
success 1 0
1619632718.330999
LookupPrivilegeValueW
system_name:
privilege_name: SeShutdownPrivilege
success 1 0
1619632718.330999
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619632718.345999
LookupPrivilegeValueW
system_name:
privilege_name: SeRemoteShutdownPrivilege
success 1 0
1619632718.345999
LookupPrivilegeValueW
system_name:
privilege_name: SeManageVolumePrivilege
success 1 0
1619632718.345999
LookupPrivilegeValueW
system_name:
privilege_name: SeCreateGlobalPrivilege
success 1 0
Created a process named as a common system process (2 个事件)
Time & API Arguments Status Return Repeated
1619632710.862751
CreateProcessInternalW
thread_identifier: 2272
thread_handle: 0x000000c0
process_identifier: 196
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
1619632717.361999
CreateProcessInternalW
thread_identifier: 2456
thread_handle: 0x000000c0
process_identifier: 2484
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
Uses Windows utilities for basic Windows functionality (1 个事件)
cmdline REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe" /f
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 78aac5cf2801892bb1d7bf0b50b4967009c577e6
buffer Buffer with sha1: 4598324d029030a6552b779d502e63a4f7687cb7
Communicates with host for which no DNS query was performed (2 个事件)
host 104.16.154.36
host 203.208.41.98
Allocates execute permission to another process indicative of possible code injection (5 个事件)
Time & API Arguments Status Return Repeated
1619632710.862751
NtAllocateVirtualMemory
process_identifier: 196
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632710.987751
NtAllocateVirtualMemory
process_identifier: 300
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632717.361999
NtAllocateVirtualMemory
process_identifier: 2484
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632717.455999
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632717.501999
NtAllocateVirtualMemory
process_identifier: 3104
region_size: 749568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000d4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\java reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Detects Avast Antivirus through the presence of a library (4 个事件)
Time & API Arguments Status Return Repeated
1619632708.424751
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619632708.424751
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619632717.330999
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619632717.330999
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
Creates known Fynloski/DarkComet files, registry keys and/or mutexes (3 个事件)
mutex DC_MUTEX-6ZFK11A
regkey HKEY_CURRENT_USER\Software\DC3_FEXEC
regkey HKEY_CURRENT_USER\Software\DC2_USERS
Potential code injection by writing to the memory of another process (13 个事件)
Time & API Arguments Status Return Repeated
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
1619632717.501999
WriteProcessMemory
process_identifier: 3104
buffer: @
process_handle: 0x000000d4
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1619632718.361999
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x004818f8
module_address: 0x00400000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 66031 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (10 个事件)
Process injection Process 2080 called NtSetContextThread to modify thread in remote process 196
Process injection Process 2080 called NtSetContextThread to modify thread in remote process 300
Process injection Process 2764 called NtSetContextThread to modify thread in remote process 2484
Process injection Process 2764 called NtSetContextThread to modify thread in remote process 2344
Process injection Process 2764 called NtSetContextThread to modify thread in remote process 3104
Time & API Arguments Status Return Repeated
1619632710.862751
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 1047636
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 196
success 0 0
1619632710.987751
NtSetContextThread
thread_handle: 0x000000d0
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4228560
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 300
success 0 0
1619632717.361999
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 2293004
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2484
success 0 0
1619632717.455999
NtSetContextThread
thread_handle: 0x000000d0
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4228560
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2344
success 0 0
1619632717.501999
NtSetContextThread
thread_handle: 0x000000d8
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4936208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3104
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (14 个事件)
Process injection Process 2080 resumed a thread in remote process 196
Process injection Process 2080 resumed a thread in remote process 300
Process injection Process 300 resumed a thread in remote process 2308
Process injection Process 300 resumed a thread in remote process 2764
Process injection Process 2764 resumed a thread in remote process 2484
Process injection Process 2764 resumed a thread in remote process 2344
Process injection Process 2764 resumed a thread in remote process 3104
Time & API Arguments Status Return Repeated
1619632710.924751
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 196
success 0 0
1619632711.002751
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 300
success 0 0
1619632714.689999
NtResumeThread
thread_handle: 0x00000274
suspend_count: 1
process_identifier: 2308
success 0 0
1619632716.392999
NtResumeThread
thread_handle: 0x000002c8
suspend_count: 1
process_identifier: 2764
success 0 0
1619632717.392999
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 2484
success 0 0
1619632717.486999
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2344
success 0 0
1619632717.533999
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 3104
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 65 个事件)
Time & API Arguments Status Return Repeated
1619632710.862751
CreateProcessInternalW
thread_identifier: 2272
thread_handle: 0x000000c0
process_identifier: 196
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
1619632710.862751
NtUnmapViewOfSection
process_identifier: 196
region_size: 7012352
process_handle: 0x000000c8
base_address: 0x00400000
failed 3221225497 0
1619632710.862751
NtAllocateVirtualMemory
process_identifier: 196
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer:
process_handle: 0x000000c8
base_address: 0x00401000
failed 0 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer:
process_handle: 0x000000c8
base_address: 0x00407000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619632710.862751
NtGetContextThread
thread_handle: 0x000000c0
success 0 0
1619632710.862751
WriteProcessMemory
process_identifier: 196
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619632710.862751
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 1047636
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 196
success 0 0
1619632710.924751
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 196
success 0 0
1619632710.987751
CreateProcessInternalW
thread_identifier: 2772
thread_handle: 0x000000d0
process_identifier: 300
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6911af2717c7a1c27735fdafdbbb3f76.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6911af2717c7a1c27735fdafdbbb3f76.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619632710.987751
NtUnmapViewOfSection
process_identifier: 300
region_size: 4096
process_handle: 0x000000cc
base_address: 0x00400000
success 0 0
1619632710.987751
NtAllocateVirtualMemory
process_identifier: 300
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer:
process_handle: 0x000000cc
base_address: 0x00400000
success 1 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer:
process_handle: 0x000000cc
base_address: 0x00401000
failed 0 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer:
process_handle: 0x000000cc
base_address: 0x00407000
success 1 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619632710.987751
NtGetContextThread
thread_handle: 0x000000d0
success 0 0
1619632710.987751
WriteProcessMemory
process_identifier: 300
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
1619632710.987751
NtSetContextThread
thread_handle: 0x000000d0
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4228560
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 300
success 0 0
1619632711.002751
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 300
success 0 0
1619632714.283999
NtResumeThread
thread_handle: 0x00000210
suspend_count: 1
process_identifier: 300
success 0 0
1619632714.470999
CreateProcessInternalW
thread_identifier: 3000
thread_handle: 0x00000274
process_identifier: 2308
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\GHEMF.bat"
filepath_r:
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x000001a0
inherit_handles: 0
success 1 0
1619632714.689999
NtResumeThread
thread_handle: 0x00000274
suspend_count: 1
process_identifier: 2308
success 0 0
1619632716.220999
CreateProcessInternalW
thread_identifier: 1712
thread_handle: 0x000002c8
process_identifier: 2764
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x000002b8
inherit_handles: 0
success 1 0
1619632716.392999
NtResumeThread
thread_handle: 0x000002c8
suspend_count: 1
process_identifier: 2764
success 0 0
1619632715.143751
CreateProcessInternalW
thread_identifier: 1176
thread_handle: 0x00000084
process_identifier: 2196
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\reg.exe
track: 1
command_line: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe" /f
filepath_r: C:\Windows\system32\reg.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000080
inherit_handles: 1
success 1 0
1619632717.361999
CreateProcessInternalW
thread_identifier: 2456
thread_handle: 0x000000c0
process_identifier: 2484
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
1619632717.361999
NtUnmapViewOfSection
process_identifier: 2484
region_size: 7012352
process_handle: 0x000000c8
base_address: 0x00400000
failed 3221225497 0
1619632717.361999
NtAllocateVirtualMemory
process_identifier: 2484
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer:
process_handle: 0x000000c8
base_address: 0x00401000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer:
process_handle: 0x000000c8
base_address: 0x00407000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619632717.361999
NtGetContextThread
thread_handle: 0x000000c0
success 0 0
1619632717.361999
WriteProcessMemory
process_identifier: 2484
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619632717.361999
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 2293004
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2484
success 0 0
1619632717.392999
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 2484
success 0 0
1619632717.455999
CreateProcessInternalW
thread_identifier: 1344
thread_handle: 0x000000d0
process_identifier: 2344
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619632717.455999
NtUnmapViewOfSection
process_identifier: 2344
region_size: 4096
process_handle: 0x000000cc
base_address: 0x00400000
success 0 0
1619632717.455999
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer:
process_handle: 0x000000cc
base_address: 0x00400000
success 1 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer:
process_handle: 0x000000cc
base_address: 0x00401000
failed 0 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer:
process_handle: 0x000000cc
base_address: 0x00407000
success 1 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619632717.455999
NtGetContextThread
thread_handle: 0x000000d0
success 0 0
1619632717.455999
WriteProcessMemory
process_identifier: 2344
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-09-05 08:15:40

Imports

Library MSVBVM60.DLL:
• 0x401000 MethCallEngine
• 0x401004
• 0x401008 EVENT_SINK_AddRef
• 0x40100c
• 0x401010
• 0x401014 DllFunctionCall
• 0x401018 EVENT_SINK_Release
• 0x401020 __vbaExceptHandler
• 0x401024
• 0x401028 ProcCallEngine
• 0x40102c

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.