14.0
0-day
53 个模型检测该样本为恶意！
重新分析
更多

cfcada9f32ecac51e844749839322ed452949ea27728fac1de34580b2319987b

6ee5343164c7575008e32bdb11d6d189.exe

分析耗时

78s

最近分析

文件大小

536.5KB
静态报毒 动态报毒 100% AETQ AGENSLA AGENTTESLA AI SCORE=82 BTTGUF CONFIDENCE ELDORADO ERRMJ FAREIT GDSDA GENERICKD HIGH CONFIDENCE HM0@AIRZBAE IGENT KRYPTIK MALICIOUS PE MODERATE PACKEDNET PWSX QQPASS QQROB SCORE TROJANPSW TSCOPE UNSAFE VSNTFA20 WUHP YAKBEEXMSIL YMACCO ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FUQ!6EE5343164C7 20200706 6.0.6.653
Alibaba TrojanPSW:MSIL/Kryptik.4d800e8b 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200706 2013.8.14.323
Tencent Msil.Trojan-qqpass.Qqrob.Wuhp 20200706 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (6 个事件)
Time & API Arguments Status Return Repeated
1619596068.593681
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621914.082626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621932.707124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621934.145124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621936.613124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619621937.660124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (50 out of 79 个事件)
Time & API Arguments Status Return Repeated
1619596032.093681
IsDebuggerPresent
failed 0 0
1619596034.265681
IsDebuggerPresent
failed 0 0
1619596034.734681
IsDebuggerPresent
failed 0 0
1619596035.280681
IsDebuggerPresent
failed 0 0
1619596035.734681
IsDebuggerPresent
failed 0 0
1619596036.280681
IsDebuggerPresent
failed 0 0
1619596036.734681
IsDebuggerPresent
failed 0 0
1619596037.280681
IsDebuggerPresent
failed 0 0
1619596037.734681
IsDebuggerPresent
failed 0 0
1619596038.280681
IsDebuggerPresent
failed 0 0
1619596038.734681
IsDebuggerPresent
failed 0 0
1619596039.280681
IsDebuggerPresent
failed 0 0
1619596039.734681
IsDebuggerPresent
failed 0 0
1619596040.280681
IsDebuggerPresent
failed 0 0
1619596040.734681
IsDebuggerPresent
failed 0 0
1619596041.280681
IsDebuggerPresent
failed 0 0
1619596041.734681
IsDebuggerPresent
failed 0 0
1619596042.280681
IsDebuggerPresent
failed 0 0
1619596042.734681
IsDebuggerPresent
failed 0 0
1619596043.280681
IsDebuggerPresent
failed 0 0
1619596043.734681
IsDebuggerPresent
failed 0 0
1619596044.280681
IsDebuggerPresent
failed 0 0
1619596044.734681
IsDebuggerPresent
failed 0 0
1619596045.280681
IsDebuggerPresent
failed 0 0
1619596045.734681
IsDebuggerPresent
failed 0 0
1619596046.280681
IsDebuggerPresent
failed 0 0
1619596046.734681
IsDebuggerPresent
failed 0 0
1619596047.280681
IsDebuggerPresent
failed 0 0
1619596047.734681
IsDebuggerPresent
failed 0 0
1619596048.280681
IsDebuggerPresent
failed 0 0
1619596048.734681
IsDebuggerPresent
failed 0 0
1619596049.280681
IsDebuggerPresent
failed 0 0
1619596049.734681
IsDebuggerPresent
failed 0 0
1619596050.280681
IsDebuggerPresent
failed 0 0
1619596050.734681
IsDebuggerPresent
failed 0 0
1619596051.280681
IsDebuggerPresent
failed 0 0
1619596051.734681
IsDebuggerPresent
failed 0 0
1619596052.280681
IsDebuggerPresent
failed 0 0
1619596052.734681
IsDebuggerPresent
failed 0 0
1619596053.280681
IsDebuggerPresent
failed 0 0
1619596053.734681
IsDebuggerPresent
failed 0 0
1619596054.280681
IsDebuggerPresent
failed 0 0
1619596054.734681
IsDebuggerPresent
failed 0 0
1619596055.280681
IsDebuggerPresent
failed 0 0
1619596055.734681
IsDebuggerPresent
failed 0 0
1619596056.280681
IsDebuggerPresent
failed 0 0
1619596056.734681
IsDebuggerPresent
failed 0 0
1619596057.280681
IsDebuggerPresent
failed 0 0
1619596057.734681
IsDebuggerPresent
failed 0 0
1619596058.280681
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619621914.645626
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\VnYYRIgxaIaEy"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619596033.062681
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619621936.192124
__exception__
stacktrace: 
0x47ffcad
0x47ff03e
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73f31b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73f48dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73f56a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73f56a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73f56a7d
StrongNameErrorInfo+0xfd79 _CorExeMain-0x4bf mscorwks+0xc6a8d @ 0x73ff6a8d
StrongNameErrorInfo+0xfc99 _CorExeMain-0x59f mscorwks+0xc69ad @ 0x73ff69ad
StrongNameErrorInfo+0x101b6 _CorExeMain-0x82 mscorwks+0xc6eca @ 0x73ff6eca
_CorExeMain+0x168 ClrCreateManagedInstance-0x42a6 mscorwks+0xc70b4 @ 0x73ff70b4
_CorExeMain+0x98 ClrCreateManagedInstance-0x4376 mscorwks+0xc6fe4 @ 0x73ff6fe4
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 4123712
registers.edi: 4123744
registers.eax: 0
registers.ebp: 4123760
registers.edx: 158
registers.ebx: 4123932
registers.esi: 42245988
registers.ecx: 0
exception.instruction_r: 8b 01 ff 50 28 89 45 d8 b8 ae 5a 3e 24 e9 55 ff
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xab039a
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 110 个事件)
Time & API Arguments Status Return Repeated
1619596031.374681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00570000
success 0 0
1619596031.374681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00600000
success 0 0
1619596031.905681
NtProtectVirtualMemory
process_identifier: 2984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619596032.109681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619596032.109681
NtProtectVirtualMemory
process_identifier: 2984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619596032.109681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00582000
success 0 0
1619596032.484681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00592000
success 0 0
1619596032.577681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00593000
success 0 0
1619596032.609681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005cb000
success 0 0
1619596032.609681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c7000
success 0 0
1619596032.655681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059c000
success 0 0
1619596032.874681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00720000
success 0 0
1619596032.999681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00721000
success 0 0
1619596033.015681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00594000
success 0 0
1619596033.030681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00722000
success 0 0
1619596033.030681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00723000
success 0 0
1619596033.124681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00724000
success 0 0
1619596033.499681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00725000
success 0 0
1619596033.609681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059a000
success 0 0
1619596033.765681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00726000
success 0 0
1619596033.796681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005ba000
success 0 0
1619596033.874681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005b2000
success 0 0
1619596033.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00595000
success 0 0
1619596034.015681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c5000
success 0 0
1619596034.155681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00596000
success 0 0
1619596034.437681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619596034.468681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00598000
success 0 0
1619596034.468681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00599000
success 0 0
1619596034.468681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00727000
success 0 0
1619596034.499681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02170000
success 0 0
1619596034.515681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00728000
success 0 0
1619596067.562681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058b000
success 0 0
1619596067.812681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02171000
success 0 0
1619596067.890681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005aa000
success 0 0
1619596067.890681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a7000
success 0 0
1619596067.952681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00729000
success 0 0
1619596067.952681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x05990000
success 0 0
1619596067.952681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a50000
success 0 0
1619596067.952681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a51000
success 0 0
1619596067.968681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a52000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a53000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a54000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a55000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a56000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a5a000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a6b000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02172000
success 0 0
1619596067.984681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a6000
success 0 0
1619596067.999681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0072a000
success 0 0
1619596068.015681
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05a6c000
success 0 0
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
cmdline schtasks.exe /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
Executes one or more WMI queries (1 个事件)
wmi SELECT * FROM Win32_VideoController
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619596069.577681
ShellExecuteExW
parameters: /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.740164231430395 section {'size_of_data': '0x00084200', 'virtual_address': '0x00002000', 'entropy': 7.740164231430395, 'name': '.text', 'virtual_size': '0x000841b4'} description A section with a high entropy has been found
entropy 0.9860074626865671 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619596033.702681
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619621918.426124
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (2 个事件)
Time & API Arguments Status Return Repeated
1619621932.160124
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2984
process_handle: 0x00000220
failed 0 0
1619621932.160124
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 2984
process_handle: 0x00000220
failed 3221225738 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
cmdline schtasks.exe /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619596072.187681
NtAllocateVirtualMemory
process_identifier: 176
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000428
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Checks the version of Bios, possibly for anti-virtualization (2 个事件)
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619596072.187681
WriteProcessMemory
process_identifier: 176
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn‚Ï^à ¬^Ë à@  @… ËOà   H.textd« ¬ `.rsrc à®@@.reloc ²@B
process_handle: 0x00000428
base_address: 0x00400000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: €0€HXàÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNamepqZqAdbZjlfsfEhYbSXGzOttgyBrSNHBXEKytdl.exe(LegalCopyright €,OriginalFilenamepqZqAdbZjlfsfEhYbSXGzOttgyBrSNHBXEKytdl.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x00000428
base_address: 0x0044e000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: À `;
process_handle: 0x00000428
base_address: 0x00450000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: @
process_handle: 0x00000428
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619596072.187681
WriteProcessMemory
process_identifier: 176
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn‚Ï^à ¬^Ë à@  @… ËOà   H.textd« ¬ `.rsrc à®@@.reloc ²@B
process_handle: 0x00000428
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2984 called NtSetContextThread to modify thread in remote process 176
Time & API Arguments Status Return Repeated
1619596072.202681
NtSetContextThread
thread_handle: 0x00000358
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4508510
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 176
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2984 resumed a thread in remote process 176
Time & API Arguments Status Return Repeated
1619596072.609681
NtResumeThread
thread_handle: 0x00000358
suspend_count: 1
process_identifier: 176
success 0 0
Detects VirtualBox through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
Detects VMWare through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Detects the presence of Wine emulator (1 个事件)
Time & API Arguments Status Return Repeated
1619596068.265681
LdrGetProcedureAddress
ordinal: 0
module: KERNEL32
module_address: 0x76340000
function_address: 0x0044daa8
function_name: wine_get_unix_file_name
failed 3221225785 0
Executed a process and injected code into it, probably while unpacking (22 个事件)
Time & API Arguments Status Return Repeated
1619596032.093681
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2984
success 0 0
1619596032.155681
NtResumeThread
thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2984
success 0 0
1619596034.140681
NtResumeThread
thread_handle: 0x00000214
suspend_count: 1
process_identifier: 2984
success 0 0
1619596034.155681
NtResumeThread
thread_handle: 0x0000022c
suspend_count: 1
process_identifier: 2984
success 0 0
1619596069.109681
NtResumeThread
thread_handle: 0x00000354
suspend_count: 1
process_identifier: 2984
success 0 0
1619596069.577681
CreateProcessInternalW
thread_identifier: 2548
thread_handle: 0x00000410
process_identifier: 2852
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnYYRIgxaIaEy" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpE6C1.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000450
inherit_handles: 0
success 1 0
1619596072.171681
CreateProcessInternalW
thread_identifier: 2344
thread_handle: 0x00000358
process_identifier: 176
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6ee5343164c7575008e32bdb11d6d189.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6ee5343164c7575008e32bdb11d6d189.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000428
inherit_handles: 0
success 1 0
1619596072.187681
NtGetContextThread
thread_handle: 0x00000358
success 0 0
1619596072.187681
NtAllocateVirtualMemory
process_identifier: 176
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000428
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619596072.187681
WriteProcessMemory
process_identifier: 176
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn‚Ï^à ¬^Ë à@  @… ËOà   H.textd« ¬ `.rsrc à®@@.reloc ²@B
process_handle: 0x00000428
base_address: 0x00400000
success 1 0
1619596072.187681
WriteProcessMemory
process_identifier: 176
buffer:
process_handle: 0x00000428
base_address: 0x00402000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: €0€HXàÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNamepqZqAdbZjlfsfEhYbSXGzOttgyBrSNHBXEKytdl.exe(LegalCopyright €,OriginalFilenamepqZqAdbZjlfsfEhYbSXGzOttgyBrSNHBXEKytdl.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x00000428
base_address: 0x0044e000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: À `;
process_handle: 0x00000428
base_address: 0x00450000
success 1 0
1619596072.202681
WriteProcessMemory
process_identifier: 176
buffer: @
process_handle: 0x00000428
base_address: 0x7efde008
success 1 0
1619596072.202681
NtSetContextThread
thread_handle: 0x00000358
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4508510
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 176
success 0 0
1619596072.609681
NtResumeThread
thread_handle: 0x00000358
suspend_count: 1
process_identifier: 176
success 0 0
1619596072.609681
NtResumeThread
thread_handle: 0x00000408
suspend_count: 1
process_identifier: 2984
success 0 0
1619621917.238124
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 176
success 0 0
1619621917.363124
NtResumeThread
thread_handle: 0x0000015c
suspend_count: 1
process_identifier: 176
success 0 0
1619621933.988124
NtResumeThread
thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 176
success 0 0
1619621934.035124
NtResumeThread
thread_handle: 0x000002f4
suspend_count: 1
process_identifier: 176
success 0 0
1619621936.317124
NtResumeThread
thread_handle: 0x00000364
suspend_count: 1
process_identifier: 176
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
MicroWorld-eScan Trojan.GenericKD.43319993
FireEye Generic.mg.6ee5343164c75750
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee Fareit-FUQ!6EE5343164C7
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005686581 )
Alibaba TrojanPSW:MSIL/Kryptik.4d800e8b
K7GW Trojan ( 005686581 )
Cybereason malicious.784d8b
Arcabit Trojan.Generic.D29502B9
TrendMicro TROJ_FRS.VSNTFA20
F-Prot W32/MSIL_Agent.BJM.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.43319993
Ad-Aware Trojan.GenericKD.43319993
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.AgentTesla.errmj
DrWeb Trojan.PackedNET.331
Zillya Trojan.Kryptik.Win32.2041477
Invincea heuristic
Trapmine malicious.moderate.ml.score
Emsisoft Trojan.GenericKD.43319993 (B)
SentinelOne DFI - Malicious PE
Cyren W32/MSIL_Agent.BJM.gen!Eldorado
Jiangmin Trojan.PSW.MSIL.aetq
Avira TR/AD.AgentTesla.errmj
Microsoft Trojan:Win32/Ymacco!rfn
Endgame malicious (high confidence)
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKD.43319993
AhnLab-V3 Trojan/Win32.AgentTesla.C4148564
BitDefenderTheta Gen:NN.ZemsilF.34130.Hm0@airZBAe
ALYac Trojan.GenericKD.43319993
MAX malware (ai score=82)
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.Agent
ESET-NOD32 a variant of MSIL/Kryptik.WGM
TrendMicro-HouseCall TROJ_FRS.VSNTFA20
Tencent Msil.Trojan-qqpass.Qqrob.Wuhp
Yandex Trojan.Igent.bTTguf.46
Ikarus Trojan.MSIL.Crypt
eGambit Unsafe.AI_Score_99%
Fortinet MSIL/Kryptik.WGM!tr
AVG Win32:PWSX-gen [Trj]
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2086-11-24 19:06:42

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.