8.8
极危
57 个模型检测该样本为恶意！
重新分析
更多

b4afc259d1032bf4ac6db0092d7b364fb11458a4c2100aa2606df6d81e5d5122

7edda525c176c63cac5444b6bc0f3921.exe

分析耗时

74s

最近分析

文件大小

124.0KB
静态报毒 动态报毒 100% AI SCORE=89 AMWR ATTRIBUTE BAMBARBIYA COBALTSTRIKE CONFIDENCE DOWNLOADER33 EMUG GDSDA GENERIC@ML GENERICKD GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HLIERY HMW@AEPI4OLI JFTJJ KLOPRANSOM KRYPT LOLOPAK MALICIOUS PE MALUCO MALWARE@#16BD1DKKKN48M MALWARECRYPTER OYQX RBSRQEB1Y86Q1E73WRGY1G RDMK SCORE UNSAFE WEELSOF ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee RDN/Generic.grp 20201022 6.0.6.653
Alibaba Ransom:Win32/KlopRansom.174 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201022 18.4.3895.0
Kingsoft 20201022 2013.8.14.323
Tencent Win32.Trojan.Lolopak.Amwr 20201022 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619649224.750727
NtAllocateVirtualMemory
process_identifier: 392
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003d0000
success 0 0
1619649224.766727
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 106496
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619659946.586751
NtAllocateVirtualMemory
process_identifier: 428
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x002b0000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619659947.695751
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
One or more of the buffers contains an embedded PE file (1 个事件)
buffer Buffer with sha1: c0f33c30896f3d924bc25ddbdbfe47088cb2ee85
Communicates with host for which no DNS query was performed (2 个事件)
host 141.255.166.171
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619649225.313727
NtAllocateVirtualMemory
process_identifier: 428
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619659950.273751
RegSetValueExA
key_handle: 0x00000338
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619659950.273751
RegSetValueExA
key_handle: 0x00000338
value: ²Pob<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619659950.273751
RegSetValueExA
key_handle: 0x00000338
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619659950.289751
RegSetValueExW
key_handle: 0x00000338
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619659950.289751
RegSetValueExA
key_handle: 0x00000350
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619659950.289751
RegSetValueExA
key_handle: 0x00000350
value: ²Pob<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619659950.289751
RegSetValueExA
key_handle: 0x00000350
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619659950.320751
RegSetValueExW
key_handle: 0x00000334
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 392 called NtSetContextThread to modify thread in remote process 428
Time & API Arguments Status Return Repeated
1619649225.313727
NtSetContextThread
thread_handle: 0x000000a8
registers.eip: 2010382788
registers.esp: 2686496
registers.edi: 0
registers.eax: 988528
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 392 resumed a thread in remote process 428
Time & API Arguments Status Return Repeated
1619649225.828727
NtResumeThread
thread_handle: 0x000000a8
suspend_count: 1
process_identifier: 428
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619649225.313727
CreateProcessInternalW
thread_identifier: 2288
thread_handle: 0x000000a8
process_identifier: 428
current_directory:
filepath:
track: 1
command_line: winver.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000ac
inherit_handles: 0
success 1 0
1619649225.313727
NtAllocateVirtualMemory
process_identifier: 428
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619649225.313727
WriteProcessMemory
process_identifier: 428
buffer:
process_handle: 0x000000ac
base_address: 0x000f0000
success 1 0
1619649225.313727
NtGetContextThread
thread_handle: 0x000000a8
success 0 0
1619649225.313727
NtSetContextThread
thread_handle: 0x000000a8
registers.eip: 2010382788
registers.esp: 2686496
registers.edi: 0
registers.eax: 988528
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
1619649225.828727
NtResumeThread
thread_handle: 0x000000a8
suspend_count: 1
process_identifier: 428
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43363994
McAfee RDN/Generic.grp
Malwarebytes Trojan.Downloader
VIPRE Trojan.Win32.Weelsof.b (v)
Sangfor Malware
K7AntiVirus Trojan ( 0056927b1 )
Alibaba Ransom:Win32/KlopRansom.174
K7GW Trojan ( 0056927b1 )
Cybereason malicious.bd2e0c
Invincea Mal/Generic-S
Cyren W32/Trojan.OYQX-8335
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Lolopak.cuo
BitDefender Trojan.GenericKD.43363994
NANO-Antivirus Trojan.Win32.GenKryptik.hliery
ViRobot Trojan.Win32.S.Agent.126976.ESS
Avast Win32:Trojan-gen
Rising Trojan.Generic@ML.87 (RDMK:rbSRQeB1y86Q1e73Wrgy1g)
Ad-Aware Trojan.GenericKD.43363994
TACHYON Trojan/W32.Lolopak.126976
Sophos Mal/Generic-S
Comodo Malware@#16bd1dkkkn48m
F-Secure Trojan.TR/AD.MalwareCrypter.jftjj
DrWeb Trojan.DownLoader33.56404
Zillya Trojan.Lolopak.Win32.124
TrendMicro Trojan.Win32.COBALTSTRIKE.A
McAfee-GW-Edition BehavesLike.Win32.Generic.cm
FireEye Generic.mg.7edda525c176c63c
Emsisoft Trojan.GenericKD.43363994 (B)
Ikarus Trojan.Win32.Krypt
GData Trojan.GenericKD.43363994
Jiangmin Trojan.Lolopak.dx
Avira TR/AD.MalwareCrypter.jftjj
Antiy-AVL Trojan/Win32.Lolopak
Arcabit Trojan.Generic.D295AE9A
AegisLab Trojan.Win32.Lolopak.4!c
ZoneAlarm Trojan.Win32.Lolopak.cuo
Microsoft Trojan:Win32/Maluco!MSR
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZexaF.34570.hmW@aepi4Oli
ALYac Trojan.Agent.Lolopak
MAX malware (ai score=89)
VBA32 Malware-Cryptor.Bambarbiya
Cylance Unsafe
ESET-NOD32 Win32/Agent.NHE
TrendMicro-HouseCall Trojan.Win32.COBALTSTRIKE.A
Tencent Win32.Trojan.Lolopak.Amwr
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (9 个事件)
dead_host 192.168.56.101:49181
dead_host 141.255.166.171:80
dead_host 192.168.56.101:49178
dead_host 192.168.56.101:49175
dead_host 192.168.56.101:49177
dead_host 192.168.56.101:49176
dead_host 192.168.56.101:49186
dead_host 192.168.56.101:49185
dead_host 192.168.56.101:49184
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-04-12 20:09:09

Imports

Library KERNEL32.dll:
• 0x406000 GetCommandLineA
• 0x406004 GetModuleHandleW
• 0x406008 VirtualAllocEx
• 0x40600c GetTickCount
• 0x406010 CreateMutexA
• 0x406014 GetProcAddress
• 0x406018 LoadLibraryW
• 0x40601c CreateEventA
• 0x406020 GetLastError
• 0x406038 GetOEMCP
• 0x406040 FindClose
• 0x406044 GetVersionExA
• 0x406048 HeapFree
• 0x40604c GetStdHandle
• 0x406050 GetVersionExW
• 0x406054 ExitProcess
• 0x406058 GetStartupInfoW
Library USER32.dll:
• 0x4060a8 LoadIconA
• 0x4060ac LoadCursorA
• 0x4060b0 LoadCursorFromFileA
Library SETUPAPI.dll:
Library MSVCRT.dll:
• 0x406060 __setusermatherr
• 0x406064 _onexit
• 0x406068 __dllonexit
• 0x40606c _controlfp
• 0x406070 _except_handler3
• 0x406074 _exit
• 0x406078 _XcptFilter
• 0x40607c exit
• 0x406080 _wcmdln
• 0x406084 __wgetmainargs
• 0x406088 _initterm
• 0x40608c __set_app_type
• 0x406090 _adjust_fdiv
• 0x406094 __p__commode
• 0x406098 __p__fmode

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.