SmartHawk

7.2

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

bb5b8b8064272a6a7cecbc51e8b17b67f8a7c15e55c61550e7602463a86a1c74

6f063cfa99f4c0f7393aa45d4bda487a.exe

分析耗时

78s

最近分析

文件大小

184.1KB

静态报毒动态报毒 100% AI SCORE=87 AIDETECTVM ATTRIBUTE BEHAVIOR BSCOPE CLASSIC CONFIDENCE ELDORADO EMOTET EMOTETO GCOR GENCIRC GENETIC HFTO HIGH CONFIDENCE HIGHCONFIDENCE HTDKIH KRYPTIK LYX@ASUXFDAI MALWARE2 PIKPO R + TROJ R349319 SCORE SUSPICIOUS PE THHBGBO TROJANBANKER TROJANX UNSAFE ZCVWZ@0 ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Emotet.48d69cbe	20190527	0.3.0.5
Avast	Win32:TrojanX-gen [Trj]	20200906	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cdf57a	20200906	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20200906	2013.8.14.323
McAfee	Emotet-FRX!6F063CFA99F4	20200906	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597520.3465 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619597511.1595 CryptGenKey	crypto_handle: 0x002ad708 algorithm_identifier: 0x0000660e () provider_handle: 0x002ad640 flags: 1 key: fbî>`#xyd÷êõ%	success	1
1619597520.3625 CryptExportKey	crypto_handle: 0x002ad708 crypto_export_handle: 0x002ae230 buffer: f¤6¸Cù«úC©{2³5þMÌùlÝflX%L6ègóE¸TÐó/¢³ØÒ6$þy\| æ[ÅnÖE4 ×ß°ï&¹»lQ Ù8,$ blob_type: 1 flags: 64	success	1
1619597555.5655 CryptExportKey	crypto_handle: 0x002ad708 crypto_export_handle: 0x002ae230 buffer: f¤[Ä}¼lkýáV¶SÒÝýC¶dZªyEWú¬Ñ¾c:ýc[,ðN\|Å6@$eJúYNëÃ²ÇÕ°J¥¨ RÑZFÇ3}Öödv¢ýA~¼¥q> blob_type: 1 flags: 64	success	1
1619597560.0655 CryptExportKey	crypto_handle: 0x002ad708 crypto_export_handle: 0x002ae230 buffer: f¤,IæÜÚÅfü<<Gôuhê8Ô Ô0]¬\Ó³!o/ü¸¬Z%kaà¿*o°v-êø¼ 6¼é »@¿á[³ª#¦~(x¯þbBÍu ¼Hb blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597510.1905 NtAllocateVirtualMemory	process_identifier: 2772 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004d0000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)

Time & API	Arguments	Status	Return
1619597510.7845 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000108 process_identifier: 192	success	1
1619597510.7845 Process32NextW	process_name: 6f063cfa99f4c0f7393aa45d4bda487a.exe snapshot_handle: 0x00000108 process_identifier: 2772	success	1
1619597520.3625 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x00000114 process_identifier: 2252	success	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597521.0185 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

6f063cfa99f4c0f7393aa45d4bda487a.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619597520.5495 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	173.81.218.65
host	45.55.36.51
host	91.83.93.99

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619597523.5655 RegSetValueExA	key_handle: 0x00000370 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619597523.5655 RegSetValueExA	key_handle: 0x00000370 value: Ð°à¤ä;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619597523.5655 RegSetValueExA	key_handle: 0x00000370 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619597523.5655 RegSetValueExW	key_handle: 0x00000370 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619597523.5655 RegSetValueExA	key_handle: 0x00000388 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619597523.5655 RegSetValueExA	key_handle: 0x00000388 value: Ð°à¤ä;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619597523.5655 RegSetValueExA	key_handle: 0x00000388 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619597523.5965 RegSetValueExW	key_handle: 0x0000036c value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Generates some ICMP traffic

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Emotet.1005
MicroWorld-eScan	Trojan.EmotetO.Gen.1
FireEye	Generic.mg.6f063cfa99f4c0f7
Qihoo-360	Win32/Trojan.492
ALYac	Trojan.Agent.Emotet
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 004ce0ea1 )
Alibaba	Trojan:Win32/Emotet.48d69cbe
K7GW	Trojan ( 004ce0ea1 )
Arcabit	Trojan.EmotetO.Gen.1
TrendMicro	TrojanSpy.Win32.EMOTET.THHBGBO
BitDefenderTheta	Gen:NN.ZexaF.34216.lyX@aSUxFdai
Cyren	W32/Emotet.ARH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Banker.Win32.Emotet.gcor
BitDefender	Trojan.EmotetO.Gen.1
NANO-Antivirus	Trojan.Win32.Emotet.htdkih
Avast	Win32:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10cdf57a
Ad-Aware	Trojan.EmotetO.Gen.1
Comodo	TrojWare.Win32.Agent.zcvwz@0
F-Secure	Trojan.TR/Crypt.Agent.pikpo
Invincea	Mal/Generic-R + Troj/Emotet-CLU
Sophos	Troj/Emotet-CLU
Ikarus	Trojan-Banker.Emotet
Jiangmin	Trojan.Banker.Emotet.ofy
Avira	TR/Crypt.Agent.pikpo
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.PED!MTB
ViRobot	Trojan.Win32.Z.Emotet.188517.M
ZoneAlarm	Trojan-Banker.Win32.Emotet.gcor
GData	Trojan.EmotetO.Gen.1
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.Emotet.R349319
McAfee	Emotet-FRX!6F063CFA99F4
TACHYON	Banker/W32.Emotet.188517
VBA32	BScope.TrojanBanker.Emotet
Malwarebytes	Trojan.Emotet
ESET-NOD32	a variant of Win32/Kryptik.HFTO
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THHBGBO
Rising	Trojan.Emotet!1.CB4A (CLASSIC)
SentinelOne	DFI - Suspicious PE
eGambit	Unsafe.AI_Score_99%

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	91.83.93.99:7080
dead_host	173.81.218.65:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 20:51:09

Imports

Library KERNEL32.dll:

• 0x414224 GetLastError

• 0x414228 ExitProcess

• 0x41422c GetModuleHandleA

• 0x414230 GetStartupInfoA

Library USER32.dll:

• 0x4143a8 ShowWindow

• 0x4143ac CreateWindowExA

• 0x4143b0 SendMessageA

• 0x4143b4 InSendMessage

Library MSVCP60.dll:

• 0x414260 ??1_Winit@std@@QAE@XZ

• 0x414264 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x414268 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x41426c ??0Init@ios_base@std@@QAE@XZ

• 0x414270 ??1Init@ios_base@std@@QAE@XZ

• 0x414274 ??0_Winit@std@@QAE@XZ

• 0x414278 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x41427c ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z

Library MSVCRT.dll:

• 0x4142b0 _controlfp

• 0x4142b4 localtime

• 0x4142b8 fclose

• 0x4142bc fseek

• 0x4142c0 ftell

• 0x4142c4 fopen

• 0x4142c8 _findfirst

• 0x4142cc strcat

• 0x4142d0 strcpy

• 0x4142d4 ??2@YAPAXI@Z

• 0x4142d8 strlen

• 0x4142dc strchr

• 0x4142e0 _findclose

• 0x4142e4 _findnext

• 0x4142e8 fwrite

• 0x4142ec printf

• 0x4142f0 _except_handler3

• 0x4142f4 fgetc

• 0x4142f8 strftime

• 0x4142fc fputc

• 0x414300 fread

• 0x414304 system

• 0x414308 putchar

• 0x41430c free

• 0x414310 sscanf

• 0x414314 __CxxFrameHandler

• 0x414318 strcmp

• 0x41431c strncpy

• 0x414320 _wcslwr

• 0x414324 malloc

• 0x414328 __dllonexit

• 0x41432c _onexit

• 0x414330 _exit

• 0x414334 _XcptFilter

• 0x414338 exit

• 0x41433c _acmdln

• 0x414340 __getmainargs

• 0x414344 _initterm

• 0x414348 __setusermatherr

• 0x41434c _adjust_fdiv

• 0x414350 __p__commode

• 0x414354 __p__fmode

• 0x414358 __set_app_type

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49182	45.55.36.51	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

URI	Data
http://45.55.36.51:443/oRkcFqVwQHhRspjEag/YD2NIclV/oHGaMXm/7N0bm6bTl6Do1y/bB5Z/	POST /oRkcFqVwQHhRspjEag/YD2NIclV/oHGaMXm/7N0bm6bTl6Do1y/bB5Z/ HTTP/1.1 Content-Type: multipart/form-data; boundary=-------------------------2f4bffe0180bcf0b3e80c54145b5f464 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 45.55.36.51:443 Content-Length: 4500 Connection: Keep-Alive Cache-Control: no-cache

URI

Data

http://45.55.36.51:443/oRkcFqVwQHhRspjEag/YD2NIclV/oHGaMXm/7N0bm6bTl6Do1y/bB5Z/

POST /oRkcFqVwQHhRspjEag/YD2NIclV/oHGaMXm/7N0bm6bTl6Do1y/bB5Z/ HTTP/1.1
Content-Type: multipart/form-data; boundary=-------------------------2f4bffe0180bcf0b3e80c54145b5f464
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 45.55.36.51:443
Content-Length: 4500
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.