3.8
中危
56 个模型检测该样本为恶意！
重新分析
更多

7984df6018af3f340757e48e5fb6105c6476c1832c23cb3ec9e0b8a08623436e

7a70273a34b020911df5e502dd02d043.exe

分析耗时

75s

最近分析

文件大小

260.0KB
静态报毒 动态报毒 AI SCORE=99 BSCOPE CLASSIC ELDORADO EMOTET EMOTETU EPSQ FNQP GENCIRC GENETIC GENKRYPTIK HFJK HIGH CONFIDENCE HQMAMS KCLOUD KRYPTIK LYPI MALWARE@#1NC2NZXB73G7I QQW@AGV QQW@HGV R346972 SCORE STATIC AI SUSGEN SUSPICIOUS PE THIBCBO TRICK TRICKBOT UNSAFE WACATAC YVYXX ZENPAK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRI!7A70273A34B0 20201211 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Alibaba Trojan:Win32/Trickbot.5c27eaad 20190527 0.3.0.5
Tencent Malware.Win32.Gencirc.10cde602 20201211 1.0.0.1
Kingsoft Win32.Troj.Banker.(kcloud) 20201211 2017.9.26.565
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619666714.101501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619666715.398501
__exception__
stacktrace: 
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x75636d97
KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77ba1278
RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77b69a5a
RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x77a7b5e7
stacktrace+0x1d1 memdup-0x62 @ 0x756205bd
hook_in_monitor+0x45 lde-0x133 @ 0x756142ea
New_ntdll_LdrGetProcedureAddress+0x43 New_ntdll_LdrLoadDll-0x156 @ 0x7562f7f3
GetProcAddress+0x60 GetModuleHandleA-0x80 kernelbase+0x4190 @ 0x7fefdc54190
SvchostPushServiceGlobals+0x471 WinHttpQueryOption-0x1a7b winhttp+0x1eb99 @ 0x7fef9efeb99
SvchostPushServiceGlobals+0x4fb WinHttpQueryOption-0x19f1 winhttp+0x1ec23 @ 0x7fef9efec23
WinHttpConnect+0x1ab WinHttpGetDefaultProxyConfiguration-0x1615 winhttp+0x13fe7 @ 0x7fef9ef3fe7

registers.r14: 19483906
registers.r9: 1970001920
registers.rcx: 0
registers.rsi: 3497824
registers.r10: 0
registers.rbx: 0
registers.rdi: 0
registers.r11: 0
registers.r8: 5
registers.rdx: 2
registers.rbp: 0
registers.r15: 1114112
registers.r12: 3310272
registers.rsp: 910592
registers.rax: 1
registers.r13: 449
exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c
exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a
exception.instruction: mov rax, qword ptr [rcx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 105050
exception.address: 0x77b69a5a
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (8 个事件)
Time & API Arguments Status Return Repeated
1619649225.778176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 184320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003c0000
success 0 0
1619649225.793176
NtProtectVirtualMemory
process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 184320
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00451000
success 0 0
1619649225.871176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004b0000
success 0 0
1619649225.871176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x10000000
success 0 0
1619649225.871176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x10001000
success 0 0
1619649226.043176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004c0000
success 0 0
1619649226.043176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619649226.043176
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004e0000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.993446893196601 section {'size_of_data': '0x0002d000', 'virtual_address': '0x00016000', 'entropy': 7.993446893196601, 'name': '.rsrc', 'virtual_size': '0x0002cba8'} description A section with a high entropy has been found
entropy 0.703125 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 个事件)
Time & API Arguments Status Return Repeated
1619666698.726501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619666702.554501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619666708.694501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.99.2.66
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.EmotetU.Gen.qqW@hGV!Lypi
FireEye Generic.mg.7a70273a34b02091
McAfee Emotet-FRI!7A70273A34B0
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056bf811 )
BitDefender Trojan.EmotetU.Gen.qqW@hGV!Lypi
K7GW Trojan ( 0056bf811 )
Cybereason malicious.467711
Arcabit Trojan.EmotetU.Gen.EDDB88
BitDefenderTheta Gen:NN.ZexaF.34670.qqW@aGV!Lypi
Cyren W32/Trickbot.ET.gen!Eldorado
Symantec Trojan.Emotet
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky Trojan-Banker.Win32.Emotet.fnqp
Alibaba Trojan:Win32/Trickbot.5c27eaad
NANO-Antivirus Trojan.Win32.Emotet.hqmams
Tencent Malware.Win32.Gencirc.10cde602
Ad-Aware Trojan.EmotetU.Gen.qqW@hGV!Lypi
TACHYON Banker/W32.Emotet.266240.E
Emsisoft Trojan.EmotetU.Gen.qqW@hGV!Lypi (B)
Comodo Malware@#1nc2nzxb73g7i
F-Secure Trojan.TR/AD.TrickBot.yvyxx
DrWeb Trojan.Trick.46644
Zillya Trojan.Emotet.Win32.23329
TrendMicro Trojan.Win32.WACATAC.THIBCBO
McAfee-GW-Edition BehavesLike.Win32.Emotet.dc
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Crypt
Jiangmin Trojan.Banker.Emotet.oar
Avira TR/AD.TrickBot.yvyxx
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Banker.(kcloud)
Gridinsoft Trojan.Win32.Agent.oa
Microsoft Trojan:Win32/Trickbot.VC!MTB
ZoneAlarm Trojan-Banker.Win32.Emotet.fnqp
GData Trojan.EmotetU.Gen.qqW@hGV!Lypi
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Trickbot.R346972
VBA32 BScope.Trojan.Zenpak
ALYac Trojan.EmotetU.Gen.qqW@hGV!Lypi
MAX malware (ai score=99)
Malwarebytes Trojan.MalPack.TRE
Panda Trj/Genetic.gen
ESET-NOD32 a variant of Win32/Kryptik.HFJK
TrendMicro-HouseCall Trojan.Win32.WACATAC.THIBCBO
Rising Trojan.Kryptik!1.C9EB (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-04 21:09:49

Imports

Library KERNEL32.dll:
• 0x40f000 GetLastError
• 0x40f004 ReadFile
• 0x40f008 WriteFile
• 0x40f020 GetCurrentProcess
• 0x40f024 SizeofResource
• 0x40f028 LoadResource
• 0x40f02c FindResourceA
• 0x40f030 LoadLibraryExW
• 0x40f034 LoadLibraryExA
• 0x40f038 CloseHandle
• 0x40f040 GetStdHandle
• 0x40f044 SetConsoleTitleA
• 0x40f048 Sleep
• 0x40f04c WaitNamedPipeA
• 0x40f050 CreateFileA
• 0x40f054 FreeConsole
• 0x40f060 InterlockedExchange
• 0x40f074 RtlUnwind
• 0x40f078 GetModuleHandleA
• 0x40f07c GetCommandLineA
• 0x40f080 GetVersionExA
• 0x40f084 RaiseException
• 0x40f088 HeapFree
• 0x40f08c ExitProcess
• 0x40f090 HeapAlloc
• 0x40f094 LCMapStringA
• 0x40f098 WideCharToMultiByte
• 0x40f09c MultiByteToWideChar
• 0x40f0a0 LCMapStringW
• 0x40f0a4 GetCPInfo
• 0x40f0a8 TlsAlloc
• 0x40f0ac SetLastError
• 0x40f0b0 GetCurrentThreadId
• 0x40f0b4 TlsFree
• 0x40f0b8 TlsSetValue
• 0x40f0bc TlsGetValue
• 0x40f0c0 GetProcAddress
• 0x40f0c4 TerminateProcess
• 0x40f0c8 GetModuleFileNameA
• 0x40f0e0 SetHandleCount
• 0x40f0e4 GetFileType
• 0x40f0e8 GetStartupInfoA
• 0x40f0ec HeapDestroy
• 0x40f0f0 HeapCreate
• 0x40f0f4 VirtualFree
• 0x40f0fc IsBadReadPtr
• 0x40f100 IsBadWritePtr
• 0x40f104 IsBadCodePtr
• 0x40f108 VirtualAlloc
• 0x40f10c HeapReAlloc
• 0x40f110 FlushFileBuffers
• 0x40f118 GetTickCount
• 0x40f11c GetCurrentProcessId
• 0x40f124 SetFilePointer
• 0x40f128 HeapSize
• 0x40f12c GetUserDefaultLCID
• 0x40f130 GetLocaleInfoA
• 0x40f134 EnumSystemLocalesA
• 0x40f138 IsValidLocale
• 0x40f13c IsValidCodePage
• 0x40f140 GetStringTypeA
• 0x40f144 GetStringTypeW
• 0x40f148 VirtualProtect
• 0x40f14c GetSystemInfo
• 0x40f150 VirtualQuery
• 0x40f154 GetACP
• 0x40f158 GetOEMCP
• 0x40f15c LoadLibraryA
• 0x40f160 SetStdHandle
• 0x40f164 GetLocaleInfoW
Library USER32.dll:
• 0x40f16c MessageBoxA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49178 185.99.2.66 443
192.168.56.101 49179 185.99.2.66 443
192.168.56.101 49182 185.99.2.66 443
192.168.56.101 49183 185.99.2.66 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.