17.2
0-day
55 个模型检测该样本为恶意！
重新分析
更多

05be3efe39ee1452a29d47648ec7babbd522df92abf484ac915915214f18eddb

7850f2d801d0b3098635ac4fb5c13f44.exe

分析耗时

127s

最近分析

文件大小

1.5MB
静态报毒 动态报毒 100% ADCD@8RNP34 AI SCORE=85 AIDETECTVM AMPM ATTRIBUTE AZ8D6EXO22F AZAT BU7TFGAQP7I CONFIDENCE DARKEYE DXWDRC EN0@AU7E75LG ESWS FYNLOSKI GENERICR GENETIC HIGH CONFIDENCE HIGHCONFIDENCE MALICIOUS PE MALWARE1 OCCAMY QVM03 R + MAL R335725 RAZY SCORE SEZF SIGGEN STATIC AI TOOL UNSAFE XJHFH ZAPCHAST ZEVBAF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/VBInject.94f21fac 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Agent-AZAT [Trj] 20201210 21.1.5827.0
Kingsoft 20201211 2017.9.26.565
McAfee GenericR-EPS!7850F2D801D0 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Command line console output was observed (4 个事件)
Time & API Arguments Status Return Repeated
1619680108.656875
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619680108.656875
WriteConsoleW
buffer: REG
console_handle: 0x00000007
success 1 0
1619680108.656875
WriteConsoleW
buffer: ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe" /f
console_handle: 0x00000007
success 1 0
1619680108.98425
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619680116.71925
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619680107.359125
__exception__
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

registers.esp: 1636412
registers.edi: 1636688
registers.eax: 1636412
registers.ebp: 1636492
registers.edx: 0
registers.ebx: 5994128
registers.esi: 1636688
registers.ecx: 2
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Connects to a Dynamic DNS Domain (1 个事件)
domain mrsnickers03.no-ip.biz
Allocates read-write-execute memory (usually to unpack itself) (50 out of 72 个事件)
Time & API Arguments Status Return Repeated
1619649229.927952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02560000
success 0 0
1619649229.927952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02570000
success 0 0
1619649229.927952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02580000
success 0 0
1619649229.927952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02590000
success 0 0
1619649229.943952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x025e0000
success 0 0
1619649229.943952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02630000
success 0 0
1619649229.943952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02680000
success 0 0
1619649229.943952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02690000
success 0 0
1619649229.959952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026a0000
success 0 0
1619649229.959952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026b0000
success 0 0
1619649230.115952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026c0000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026d0000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026e0000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026f0000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a10000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a20000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a30000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a40000
success 0 0
1619649230.131952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a50000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a60000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a70000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a80000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02a90000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02aa0000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ab0000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ac0000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ad0000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ae0000
success 0 0
1619649230.865952
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02af0000
success 0 0
1619680105.187375
NtProtectVirtualMemory
process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619680105.672125
NtProtectVirtualMemory
process_identifier: 2288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619680176.531875
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004080000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01da0000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01db0000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01dc0000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01dd0000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01de0000
success 0 0
1619680114.2035
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01df0000
success 0 0
1619680114.2195
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e00000
success 0 0
1619680114.2195
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e10000
success 0 0
1619680114.2195
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e20000
success 0 0
1619680114.2195
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e70000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e80000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e90000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ea0000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01eb0000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ec0000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ed0000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026a0000
success 0 0
1619680114.2975
NtAllocateVirtualMemory
process_identifier: 3128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x026b0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (1 个事件)
name RT_VERSION offset 0x001799d0 filetype data sublanguage SUBLANG_ARABIC_MOROCCO size 0x00000380
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Creates a suspicious process (1 个事件)
cmdline C:\Windows\System32\svchost.exe
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619680108.390125
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\QYMNA.bat
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\QYMNA.bat
show_type: 0
success 1 0
1619680113.328125
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1619649228.787952
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00360000
success 0 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (50 out of 76 个事件)
Time & API Arguments Status Return Repeated
1619680117.078625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680118.594625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680120.094625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680121.640625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680123.156625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680124.672625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680126.187625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680127.703625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680129.219625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680130.750625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680132.265625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680133.781625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680135.281625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680136.828625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680138.344625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680139.859625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680141.375625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680142.890625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680144.406625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680145.922625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680147.437625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680148.953625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680150.469625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680151.984625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680153.500625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680155.015625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680156.531625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680158.047625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680159.562625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680161.078625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680162.625625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680164.140625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680165.656625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680167.265625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680168.765625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680170.297625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680171.828625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680173.344625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680174.844625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680176.359625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680177.875625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680179.437625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680180.969625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680182.500625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680184.031625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680185.562625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680187.109625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680188.640625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680190.156625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619680191.672625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Created a process named as a common system process (2 个事件)
Time & API Arguments Status Return Repeated
1619649230.521952
CreateProcessInternalW
thread_identifier: 2560
thread_handle: 0x000000c0
process_identifier: 2060
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
1619680114.4695
CreateProcessInternalW
thread_identifier: 3204
thread_handle: 0x000000c0
process_identifier: 3200
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\svchost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000c8
inherit_handles: 0
success 1 0
Uses Windows utilities for basic Windows functionality (1 个事件)
cmdline REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe" /f
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 78aac5cf2801892bb1d7bf0b50b4967009c577e6
buffer Buffer with sha1: 4598324d029030a6552b779d502e63a4f7687cb7
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (5 个事件)
Time & API Arguments Status Return Repeated
1619649230.521952
NtAllocateVirtualMemory
process_identifier: 2060
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619649231.006952
NtAllocateVirtualMemory
process_identifier: 2288
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619680114.4695
NtAllocateVirtualMemory
process_identifier: 3200
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000c8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619680114.9065
NtAllocateVirtualMemory
process_identifier: 3272
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619680115.3905
NtAllocateVirtualMemory
process_identifier: 3336
region_size: 749568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000d4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\java reg_value C:\Users\Administrator.Oskar-PC\AppData\Roaming\IDM\ichader.exe
Detects Avast Antivirus through the presence of a library (4 个事件)
Time & API Arguments Status Return Repeated
1619649229.959952
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619649229.959952
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619680114.2195
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
1619680114.2195
LdrGetDllHandle
module_name: snxhk.dll
stack_pivoted: 0
module_address: 0x00000000
failed 3221225781 0
Creates known Fynloski/DarkComet files, registry keys and/or mutexes (3 个事件)
mutex DC_MUTEX-6ZFK11A
regkey HKEY_CURRENT_USER\Software\DC3_FEXEC
regkey HKEY_CURRENT_USER\Software\DC2_USERS
Potential code injection by writing to the memory of another process (13 个事件)
Time & API Arguments Status Return Repeated
1619649230.521952
WriteProcessMemory
process_identifier: 2060
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619649230.521952
WriteProcessMemory
process_identifier: 2060
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619649230.521952
WriteProcessMemory
process_identifier: 2060
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619649230.521952
WriteProcessMemory
process_identifier: 2060
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619649231.006952
WriteProcessMemory
process_identifier: 2288
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619649231.006952
WriteProcessMemory
process_identifier: 2288
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
1619680114.4695
WriteProcessMemory
process_identifier: 3200
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619680114.4845
WriteProcessMemory
process_identifier: 3200
buffer: ¤t P(€Ȁ€¤t P1uP€2ux€3u €¤t PhL¡0°¤t P€¢è°¤t P¸l¥(°¤t Pà€¤t Pø˜¦0°¤t P €¤t P 8̦(°¸g( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÐd( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¨c( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿxc 01u è2u(3uPa(4VS_VERSION_INFO½ïþDVarFileInfo$Translation °ˆStringFileInfod040904B0D$CompanyNameArachnid Software4ProductNameWatchIt!, FileVersion1.000 ProductVersion1.004InternalNameWatchIt!DOriginalFilenameWatchIt!.exeT©0©a©L©n©|©Œ©œ©ª©¸©h€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000c8
base_address: 0x0040a000
success 1 0
1619680114.4845
WriteProcessMemory
process_identifier: 3200
buffer: ¿@‰@ÿàŠ@t/¡ƒÇ»°@ÿã¾@‰@ÿæÐ,°x\ôàÈ÷÷÷Dt9ôô`ô¢]Ct9ôq²Bœôe³Bt9ô\Cœôœôt9ôìr-€fò H. Œ£uðò(ôÕq w}¯¼7þÿÿÿŒã›wòà›w\ôdôÿÿÿÿÐ,Àóìó³ý~bÜó BÂu0³ý~ô`-€fò :/*8ôRç›wheòxfòô#à›wdôdôxfò,ô¨æ›w-€fò<ôæ›w€fòþÿÿÿô¢íËvdô;0Êv²øÍV€öŒ ¬ô„ŠCEdôœô€öt9ôå±Bt9ô€öt9ôÓYC½Œ Œ ö¼‹CŒ
process_handle: 0x000000c8
base_address: 0x0040b000
success 1 0
1619680114.4845
WriteProcessMemory
process_identifier: 3200
buffer: @
process_handle: 0x000000c8
base_address: 0x7efde008
success 1 0
1619680114.9065
WriteProcessMemory
process_identifier: 3272
buffer: ô϶O0€Ѐ€P€ô϶O1uX€2u€€3u¨€ô϶Opœ¡0°ô϶O˜Ð¢è°ô϶OÀ¼¥(°ô϶Oè€ô϶Oè¦0°ô϶O(€ô϶O @§À°€h€€à¨&PUT˜a( @ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿü<ÿÃüø?üûÿüûÿüûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿýÿûÿÁÿûü=ÿûÃÁÿø<?ÿûÃÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿÀøøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÈb( @€€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÿpÿÿÿwpÿÿÿÿÿÿwwpÿÿÿÿÿÿÿÿwpÿÿÿÿÿÿÿÿpÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿˆˆÿÿÿÿˆˆÿÿˆˆîîîîîîîÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÁÿÿüÿ€øøøøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿøÿø?ÿøÿÿø?ÿÿûÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ°e( À€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿðwÿÿðwpÿÿÿðpÿÿÿðÿÿÿðÿÿ€€àîààÿÿÿÿÿøÀÀÀÀÀÀÀÀÇÿÿÿÿÿÿÿØf 01u è2u(3ugÀ4VS_VERSION_INFO½ïþDVarFileInfo$Translation ° StringFileInfoü040904B00ProductNameCRITIC, FileVersion1.000 ProductVersion1.00$InternalNamea4 OriginalFilenamea.exeÈhjava*1*|OFF|*appdata*IDM\*ichader.exe*h©D©u©`©‚©© ©°©¾©Ì©k€KERNEL32.DLLMSVBVM60.DLLLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess
process_handle: 0x000000cc
base_address: 0x0040a000
success 1 0
1619680114.9065
WriteProcessMemory
process_identifier: 3272
buffer: @
process_handle: 0x000000cc
base_address: 0x7efde008
success 1 0
1619680115.3905
WriteProcessMemory
process_identifier: 3336
buffer: @
process_handle: 0x000000d4
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619649230.521952
WriteProcessMemory
process_identifier: 2060
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
1619680114.4695
WriteProcessMemory
process_identifier: 3200
buffer: MZÿÿ¸@@PEL¤t Pà 0`°p @Àý0ô¨Ô ôtext``€àdata0p&@à.rsrc  (@À.MUX°2Ð,ô,lòàà
process_handle: 0x000000c8
base_address: 0x00400000
success 1 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1619680116.85925
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x004818f8
module_address: 0x00400000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 65861 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (10 个事件)
Process injection Process 648 called NtSetContextThread to modify thread in remote process 2060
Process injection Process 648 called NtSetContextThread to modify thread in remote process 2288
Process injection Process 3128 called NtSetContextThread to modify thread in remote process 3200
Process injection Process 3128 called NtSetContextThread to modify thread in remote process 3272
Process injection Process 3128 called NtSetContextThread to modify thread in remote process 3336
Time & API Arguments Status Return Repeated
1619649230.521952
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 1309028
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2060
success 0 0
1619649231.006952
NtSetContextThread
thread_handle: 0x000000d0
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4228560
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2288
success 0 0
1619680114.4845
NtSetContextThread
thread_handle: 0x000000c0
registers.eip: 2010382788
registers.esp: 3078508
registers.edi: 0
registers.eax: 4239360
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3200
success 0 0
1619680114.9065
NtSetContextThread
thread_handle: 0x000000d0
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4228560
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3272
success 0 0
1619680115.3905
NtSetContextThread
thread_handle: 0x000000d8
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4936208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3336
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (14 个事件)
Process injection Process 648 resumed a thread in remote process 2060
Process injection Process 648 resumed a thread in remote process 2288
Process injection Process 2288 resumed a thread in remote process 3056
Process injection Process 2288 resumed a thread in remote process 3128
Process injection Process 3128 resumed a thread in remote process 3200
Process injection Process 3128 resumed a thread in remote process 3272
Process injection Process 3128 resumed a thread in remote process 3336
Time & API Arguments Status Return Repeated
1619649230.756952
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 2060
success 0 0
1619649231.224952
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2288
success 0 0
1619680108.390125
NtResumeThread
thread_handle: 0x000001a0
suspend_count: 1
process_identifier: 3056
success 0 0
1619680113.328125
NtResumeThread
thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 3128
success 0 0
1619680114.7195
NtResumeThread
thread_handle: 0x000000c0
suspend_count: 1
process_identifier: 3200
success 0 0
1619680115.2815
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 3272
success 0 0
1619680115.8125
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 3336
success 0 0
Generates some ICMP traffic
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-09-05 08:15:40

Imports

Library MSVBVM60.DLL:
• 0x401000 MethCallEngine
• 0x401004
• 0x401008 EVENT_SINK_AddRef
• 0x40100c
• 0x401010
• 0x401014 DllFunctionCall
• 0x401018 EVENT_SINK_Release
• 0x401020 __vbaExceptHandler
• 0x401024
• 0x401028 ProcCallEngine
• 0x40102c

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.