4.0
中危
58 个模型检测该样本为恶意！
重新分析
更多

e70a5e9914839c1e78c02c39ef366762f6d3df3a3686a09359e7922ba6913964

773508ddf0184cf2cb086bd9e9f441fd.exe

分析耗时

55s

最近分析

文件大小

645.6KB
静态报毒 动态报毒 AAZV AGEN AI SCORE=86 AIDETECTVM ATTRIBUTE CLASSIC CONFIDENCE ELDORADO EMOTET EMOTETU GENCIRC GENETIC HCSD HIGH CONFIDENCE HIGHCONFIDENCE HN@8QO1E7 HPDVBT KRYPTIK KZIP MALWARE1 OU1@ACSK5RPI OU1@HCSK5RPI QVM41 R + TROJ R332838 SCORE SMTHD SUSGEN TRICKBO TRICKBOT TRICKSTER TROJANX UNSAFE URW+JIBLLJM ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Backdoor:Win32/KZip.f702d11d 20190527 0.3.0.5
Avast Win32:TrojanX-gen [Trj] 20201229 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201229 2017.9.26.565
McAfee Emotet-FQC!773508DDF018 20201229 6.0.6.653
Tencent Malware.Win32.Gencirc.10b9d3ce 20201229 1.0.0.1
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619671214.55302
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619671632.956499
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path c:\Users\User\Desktop\2008\SEED\Release\SEED.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619671214.50602
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (6 个事件)
Time & API Arguments Status Return Repeated
1619671214.38102
__exception__
stacktrace: 
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
hook_in_monitor+0x45 lde-0x133 @ 0x756142ea
New_ntdll_NtOpenFile+0x2b New_ntdll_NtOpenKey-0x1ce @ 0x75632c8b
GetVolumeInformationW+0xda GetVolumeInformationByHandleW-0xc6 kernelbase+0x1ab4a @ 0x7fefdc6ab4a
GetVolumeInformationW+0x35 RtlMoveMemory-0x553 kernel32+0x22185 @ 0x77a52185
0x122b2c
0xce900

registers.r14: 846080
registers.r9: 1970009600
registers.rcx: 0
registers.rsi: 0
registers.r10: 0
registers.rbx: 844908
registers.rdi: 844944
registers.r11: 0
registers.r8: 5
registers.rdx: 2
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 844848
registers.rax: 1
registers.r13: 0
exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c
exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a
exception.instruction: mov rax, qword ptr [rcx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 105050
exception.address: 0x77b69a5a
success 0 0
1619671215.11602
__exception__
stacktrace: 
0x127450
0x117f0d

registers.r14: 846080
registers.r9: 0
registers.rcx: 844256
registers.rsi: 0
registers.r10: 54
registers.rbx: 104
registers.rdi: 1258408
registers.r11: 27
registers.r8: 0
registers.rdx: 512
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 843624
registers.rax: 0
registers.r13: 2007313264
exception.instruction_r: 47 0f b7 14 48 66 45 85 d2 74 29 66 44 89 11 48
exception.instruction: movzx r10d, word ptr [r8 + r9*2]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x127450
success 0 0
1619671215.13102
__exception__
stacktrace: 
0x127450
0x117f0d

registers.r14: 846080
registers.r9: 0
registers.rcx: 844256
registers.rsi: 0
registers.r10: 54
registers.rbx: 104
registers.rdi: 1258408
registers.r11: 27
registers.r8: 0
registers.rdx: 512
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 843624
registers.rax: 0
registers.r13: 2007313264
exception.instruction_r: 47 0f b7 14 48 66 45 85 d2 74 29 66 44 89 11 48
exception.instruction: movzx r10d, word ptr [r8 + r9*2]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x127450
success 0 0
1619671215.13102
__exception__
stacktrace: 
0x127450
0x117f0d

registers.r14: 846080
registers.r9: 0
registers.rcx: 844256
registers.rsi: 0
registers.r10: 54
registers.rbx: 104
registers.rdi: 1258408
registers.r11: 27
registers.r8: 0
registers.rdx: 512
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 843624
registers.rax: 0
registers.r13: 2007313264
exception.instruction_r: 47 0f b7 14 48 66 45 85 d2 74 29 66 44 89 11 48
exception.instruction: movzx r10d, word ptr [r8 + r9*2]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x127450
success 0 0
1619671215.13102
__exception__
stacktrace: 
0x127450
0x117f0d

registers.r14: 846080
registers.r9: 0
registers.rcx: 844256
registers.rsi: 0
registers.r10: 54
registers.rbx: 104
registers.rdi: 1258408
registers.r11: 27
registers.r8: 0
registers.rdx: 512
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 843624
registers.rax: 0
registers.r13: 2007313264
exception.instruction_r: 47 0f b7 14 48 66 45 85 d2 74 29 66 44 89 11 48
exception.instruction: movzx r10d, word ptr [r8 + r9*2]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x127450
success 0 0
1619671215.13102
__exception__
stacktrace: 
0x127450
0x117f0d

registers.r14: 846080
registers.r9: 0
registers.rcx: 844256
registers.rsi: 0
registers.r10: 54
registers.rbx: 104
registers.rdi: 1258408
registers.r11: 27
registers.r8: 0
registers.rdx: 512
registers.rbp: 0
registers.r15: 0
registers.r12: 0
registers.rsp: 843624
registers.rax: 0
registers.r13: 2007313264
exception.instruction_r: 47 0f b7 14 48 66 45 85 d2 74 29 66 44 89 11 48
exception.instruction: movzx r10d, word ptr [r8 + r9*2]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x127450
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (9 个事件)
Time & API Arguments Status Return Repeated
1619671632.987499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 188416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01c90000
success 0 0
1619671632.987499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01cc0000
success 0 0
1619671633.112499
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02691000
success 0 0
1619671643.377499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x026d0000
success 0 0
1619671643.377499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x10000000
success 0 0
1619671643.377499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x10001000
success 0 0
1619671643.377499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x026e0000
success 0 0
1619671643.440499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x026f0000
success 0 0
1619671643.440499
NtAllocateVirtualMemory
process_identifier: 472
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02700000
success 0 0
Creates hidden or system file (8 个事件)
Time & API Arguments Status Return Repeated
1619671633.065499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.065499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.065499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.065499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.081499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.081499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.081499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
1619671633.081499
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed 3221225525 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Packed.140
MicroWorld-eScan Trojan.EmotetU.Gen.Ou1@hCSK5rpi
FireEye Generic.mg.773508ddf0184cf2
CAT-QuickHeal Trojan.Zenpak
ALYac Trojan.Trickster.Gen
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Sangfor Malware
K7AntiVirus Trojan ( 00564b241 )
Alibaba Backdoor:Win32/KZip.f702d11d
K7GW Trojan ( 00564b241 )
Cybereason malicious.df0184
Arcabit Trojan.EmotetU.Gen.E32CCD
BitDefenderTheta Gen:NN.ZexaF.34700.Ou1@aCSK5rpi
Cyren W32/Trickbot.DI.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Zenpak.aazv
BitDefender Trojan.EmotetU.Gen.Ou1@hCSK5rpi
NANO-Antivirus Trojan.Win32.Zenpak.hpdvbt
ViRobot Trojan.Win32.Z.Trickbot.661106
Avast Win32:TrojanX-gen [Trj]
Rising Trojan.Kryptik!1.C50A (CLASSIC)
Ad-Aware Trojan.EmotetU.Gen.Ou1@hCSK5rpi
Emsisoft Trojan.EmotetU.Gen.Ou1@hCSK5rpi (B)
Comodo TrojWare.Win32.TrickBot.HN@8qo1e7
F-Secure Heuristic.HEUR/AGEN.1133736
TrendMicro TrojanSpy.Win32.EMOTET.SMTHD.hp
McAfee-GW-Edition BehavesLike.Win32.Emotet.jh
Sophos Mal/Generic-R + Troj/Trickbo-WE
Ikarus Trojan.Win32.Trickbot
Jiangmin Trojan.Zenpak.bmg
Avira HEUR/AGEN.1133736
Antiy-AVL Trojan/Win32.TrickBot
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft Trojan:Win32/Trickbot.CJ!rfn
ZoneAlarm Trojan.Win32.Zenpak.aazv
GData Trojan.EmotetU.Gen.Ou1@hCSK5rpi
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R332838
McAfee Emotet-FQC!773508DDF018
MAX malware (ai score=86)
VBA32 Trojan.Packed
Malwarebytes Trojan.TrickBot
ESET-NOD32 a variant of Win32/Kryptik.HCSD
TrendMicro-HouseCall TrojanSpy.Win32.EMOTET.SMTHD.hp
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-14 00:17:17

Imports

Library CRYPT32.dll:
Library KERNEL32.dll:
• 0x45d378 GetModuleHandleA
• 0x45d37c LoadLibraryW
• 0x45d388 GetCurrentThread
• 0x45d38c CompareStringW
• 0x45d390 CompareStringA
• 0x45d398 FlushFileBuffers
• 0x45d39c CloseHandle
• 0x45d3a0 CreateFileA
• 0x45d3a4 LoadLibraryA
• 0x45d3a8 IsValidLocale
• 0x45d3ac EnumSystemLocalesA
• 0x45d3b0 GetLocaleInfoA
• 0x45d3b4 GetUserDefaultLCID
• 0x45d3b8 GetDateFormatA
• 0x45d3bc GetTimeFormatA
• 0x45d3c0 GetStringTypeW
• 0x45d3c4 GetStringTypeA
• 0x45d3c8 LCMapStringW
• 0x45d3cc LCMapStringA
• 0x45d3d0 WriteConsoleW
• 0x45d3d4 GetConsoleOutputCP
• 0x45d3d8 WriteConsoleA
• 0x45d3e0 GetLocaleInfoW
• 0x45d3e4 GetLastError
• 0x45d3e8 HeapFree
• 0x45d3ec HeapAlloc
• 0x45d3f0 RaiseException
• 0x45d3f4 RtlUnwind
• 0x45d3f8 GetCommandLineA
• 0x45d3fc GetStartupInfoA
• 0x45d400 TerminateProcess
• 0x45d404 GetCurrentProcess
• 0x45d410 IsDebuggerPresent
• 0x45d414 HeapCreate
• 0x45d418 HeapDestroy
• 0x45d41c VirtualFree
• 0x45d428 FatalAppExitA
• 0x45d430 VirtualAlloc
• 0x45d434 HeapReAlloc
• 0x45d438 GetModuleHandleW
• 0x45d43c Sleep
• 0x45d440 GetProcAddress
• 0x45d444 ExitProcess
• 0x45d448 WriteFile
• 0x45d44c GetStdHandle
• 0x45d450 GetModuleFileNameA
• 0x45d454 TlsGetValue
• 0x45d458 TlsAlloc
• 0x45d45c TlsSetValue
• 0x45d460 TlsFree
• 0x45d468 SetLastError
• 0x45d46c GetCurrentThreadId
• 0x45d480 WideCharToMultiByte
• 0x45d488 SetHandleCount
• 0x45d48c GetFileType
• 0x45d490 GetTickCount
• 0x45d494 GetCurrentProcessId
• 0x45d49c SetFilePointer
• 0x45d4a0 GetConsoleCP
• 0x45d4a4 GetConsoleMode
• 0x45d4a8 GetCPInfo
• 0x45d4ac GetACP
• 0x45d4b0 GetOEMCP
• 0x45d4b4 IsValidCodePage
• 0x45d4b8 MultiByteToWideChar
• 0x45d4c4 FreeLibrary
• 0x45d4c8 InterlockedExchange
• 0x45d4cc HeapSize
• 0x45d4d0 SetStdHandle
Library USER32.dll:
• 0x45d548 GetMessageW
• 0x45d54c DispatchMessageW
• 0x45d550 TranslateMessage
• 0x45d554 LoadIconW
• 0x45d558 LoadCursorW
• 0x45d55c RegisterClassExW
• 0x45d560 CreateWindowExW
• 0x45d564 ShowWindow
• 0x45d568 UpdateWindow
• 0x45d56c DefWindowProcW
• 0x45d570 BeginPaint
• 0x45d574 EndPaint
• 0x45d578 PostQuitMessage
• 0x45d57c SetTimer
• 0x45d580 InvalidateRect
• 0x45d584 GetDesktopWindow
• 0x45d588 FillRect
• 0x45d58c DrawTextW
• 0x45d590 KillTimer
Library GDI32.dll:
• 0x45d348 GetStockObject

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.