SmartHawk

8.0

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

05568298144f10100f3882592a8be0a1754c579f581a3db6316d014c7f8ca8f3

6fa5d1729bcb93c460bd3bb3ebf53eb4.exe

分析耗时

82s

最近分析

文件大小

510.0KB

静态报毒动态报毒 100% AI SCORE=82 ANDROM ATTRIBUTE CLOUD CONFIDENCE DTRLK ELDORADO EQPO FM0@AAB4SRO GDSDA GEN@0 GENERICKD GENKRYPTIK HACKTOOL HIGH CONFIDENCE HIGHCONFIDENCE HSMLIA KRYPTIK MALICIOUS PE MIMIKATZ MSILKRYPT PACKEDNET PWSX QJGW QVM03 R002C0DHJ20 R348272 SCORE SUSGEN TSCOPE UNCLASSIFIED UNSAFE WOREFLINT WTEB ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic.rp	20200827	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20200827	18.4.3895.0
Alibaba	HackTool:MSIL/Mimikatz.def46c01	20190527	0.3.0.5
Kingsoft		20200827	2013.8.14.323
Tencent	Msil.Trojan.Agent.Wteb	20200827	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619615754.130374 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596030.791979 IsDebuggerPresent		failed	0	0
1619596082.431979 IsDebuggerPresent		failed	0	0
1619596082.931979 IsDebuggerPresent		failed	0	0
1619615741.520374 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596031.634979 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 124 个事件)

Time & API	Arguments	Status	Return
1619596029.916979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005c0000	success	0
1619596029.916979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00690000	success	0
1619596030.603979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success	0
1619596030.791979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success	0
1619596030.791979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success	0
1619596030.791979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c2000	success	0
1619596031.134979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success	0
1619596031.322979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e3000	success	0
1619596031.353979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success	0
1619596031.353979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success	0
1619596031.400979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success	0
1619596031.509979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success	0
1619596031.603979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00531000	success	0
1619596031.666979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success	0
1619596032.197979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e4000	success	0
1619596032.228979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e5000	success	0
1619596032.259979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e6000	success	0
1619596032.291979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e7000	success	0
1619596032.338979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success	0
1619596032.338979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success	0
1619596032.353979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success	0
1619596032.369979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success	0
1619596032.416979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00533000	success	0
1619596032.588979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00535000	success	0
1619596032.697979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00442000	success	0
1619596032.728979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00455000	success	0
1619596032.806979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f6000	success	0
1619596032.822979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e8000	success	0
1619596032.884979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success	0
1619596074.400979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00691000	success	0
1619596074.431979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success	0
1619596074.525979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044c000	success	0
1619596074.572979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00538000	success	0
1619596074.588979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e9000	success	0
1619596074.603979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00539000	success	0
1619596074.666979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success	0
1619596074.697979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e0000	success	0
1619596074.697979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 353280 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04cb0400	failed	3221225550
1619596081.806979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success	0
1619596081.822979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053b000	success	0
1619596081.853979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053c000	success	0
1619596081.978979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053d000	success	0
1619596081.994979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053e000	success	0
1619596082.197979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02300000	success	0
1619596082.213979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053f000	success	0
1619596082.259979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04da0000	success	0
1619596082.259979 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04da1000	success	0
1619596082.275979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04cb0178	failed	3221225550
1619596082.275979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04cb01a0	failed	3221225550
1619596082.275979 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04cb01c8	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.9269561669950726

section

{'size_of_data': '0x0007ee00', 'virtual_address': '0x00002000', 'entropy': 7.9269561669950726, 'name': '.text', 'virtual_size': '0x0007ed44'}

description

A section with a high entropy has been found

entropy

0.9960745829244357

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596074.697979 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619615753.661374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596082.681979 NtAllocateVirtualMemory	process_identifier: 284 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00003abc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619596082.681979 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¨&;_àö @ `@8S ð@ H.textô ö `.rsrcð ø@@.reloc@ü@B process_handle: 0x00003abc base_address: 0x00400000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: 0HX 4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameHSWCrgWHRkvWxlfolzWrBSdaUv.exe(LegalCopyright hOriginalFilenameHSWCrgWHRkvWxlfolzWrBSdaUv.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00003abc base_address: 0x00462000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: 4 process_handle: 0x00003abc base_address: 0x00464000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: @ process_handle: 0x00003abc base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596082.681979 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¨&;_àö @ `@8S ð@ H.textô ö `.rsrcð ø@@.reloc@ü@B process_handle: 0x00003abc base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 called NtSetContextThread to modify thread in remote process 284
1619596082.697979 NtSetContextThread	thread_handle: 0x0000f8f4 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4592782 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 284	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 resumed a thread in remote process 284
1619596082.994979 NtResumeThread	thread_handle: 0x0000f8f4 suspend_count: 1 process_identifier: 284	success	0	0

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1619596030.791979 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2984	success	0
1619596030.869979 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2984	success	0
1619596082.400979 NtResumeThread	thread_handle: 0x000096fc suspend_count: 1 process_identifier: 2984	success	0
1619596082.416979 NtResumeThread	thread_handle: 0x0000dd48 suspend_count: 1 process_identifier: 2984	success	0
1619596082.681979 CreateProcessInternalW	thread_identifier: 2948 thread_handle: 0x0000f8f4 process_identifier: 284 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6fa5d1729bcb93c460bd3bb3ebf53eb4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6fa5d1729bcb93c460bd3bb3ebf53eb4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00003abc inherit_handles: 0	success	1
1619596082.681979 NtGetContextThread	thread_handle: 0x0000f8f4	success	0
1619596082.681979 NtAllocateVirtualMemory	process_identifier: 284 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00003abc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619596082.681979 WriteProcessMemory	process_identifier: 284 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¨&;_àö @ `@8S ð@ H.textô ö `.rsrcð ø@@.reloc@ü@B process_handle: 0x00003abc base_address: 0x00400000	success	1
1619596082.681979 WriteProcessMemory	process_identifier: 284 buffer: process_handle: 0x00003abc base_address: 0x00402000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: 0HX 4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ôStringFileInfoÐ000004b0,FileDescription 0FileVersion0.0.0.0`InternalNameHSWCrgWHRkvWxlfolzWrBSdaUv.exe(LegalCopyright hOriginalFilenameHSWCrgWHRkvWxlfolzWrBSdaUv.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00003abc base_address: 0x00462000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: 4 process_handle: 0x00003abc base_address: 0x00464000	success	1
1619596082.697979 WriteProcessMemory	process_identifier: 284 buffer: @ process_handle: 0x00003abc base_address: 0x7efde008	success	1
1619596082.697979 NtSetContextThread	thread_handle: 0x0000f8f4 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4592782 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 284	success	0
1619596082.994979 NtResumeThread	thread_handle: 0x0000f8f4 suspend_count: 1 process_identifier: 284	success	0
1619596082.994979 NtResumeThread	thread_handle: 0x0000b2a0 suspend_count: 1 process_identifier: 2984	success	0
1619596083.025979 NtGetContextThread	thread_handle: 0x0000b2a0	success	0
1619596083.025979 NtGetContextThread	thread_handle: 0x0000b2a0	success	0
1619596083.025979 NtResumeThread	thread_handle: 0x0000b2a0 suspend_count: 1 process_identifier: 2984	success	0
1619615741.520374 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 284	success	0
1619615741.630374 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 284	success	0
1619615756.427374 NtResumeThread	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 284	success	0
1619615756.552374 NtResumeThread	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 284	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34381810
FireEye	Generic.mg.6fa5d1729bcb93c4
CAT-QuickHeal	Trojan.Multi
Qihoo-360	Generic/HEUR/QVM03.0.539D.Malware.Gen
McAfee	RDN/Generic.rp
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.34381810
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.e9c8a6
Invincea	heuristic
Cyren	W32/MSIL_Kryptik.BKZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
Alibaba	HackTool:MSIL/Mimikatz.def46c01
NANO-Antivirus	Trojan.Win32.Androm.hsmlia
ViRobot	Trojan.Win32.Z.Packednet.522240
AegisLab	Trojan.MSIL.Agent.4!c
Rising	Trojan.Woreflint!8.F5EA (CLOUD)
Ad-Aware	Trojan.GenericKD.34381810
Comodo	TrojWare.Win32.Unclassified.gen@0
F-Secure	Trojan.TR/Kryptik.dtrlk
DrWeb	Trojan.PackedNET.405
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DHJ20
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
GData	Trojan.GenericKD.34381810
Jiangmin	Trojan.MSIL.qjgw
Avira	TR/Kryptik.dtrlk
Antiy-AVL	Trojan/MSIL.Kryptik
Arcabit	Trojan.Generic.D20C9FF2
ZoneAlarm	HEUR:Backdoor.MSIL.Androm.gen
Microsoft	HackTool:Win64/Mimikatz.A
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.MSILKrypt.R348272
BitDefenderTheta	Gen:NN.ZemsilF.34196.Fm0@aaB4SRo
ALYac	Trojan.GenericKD.34381810
MAX	malware (ai score=82)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack.PNG.Generic
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Kryptik.XJJ
TrendMicro-HouseCall	TROJ_GEN.R002C0DHJ20
Tencent	Msil.Trojan.Agent.Wteb
Ikarus	Trojan.MSIL.Crypt
eGambit	Unsafe.AI_Score_99%

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-18 11:53:35

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.110
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.