5.6
高危
该样本未表现出任何异常！
重新分析
更多

3b02158567db85c083a53d451b2f202e1fc2312e50348a8deb0f3fb63b1ad1a3

811f728030be9df8a4b0b7ea33912723.exe

分析耗时

106s

最近分析

文件大小

219.1KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620848260.237501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1620848254.971501
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 61440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00440000
success 0 0
1620848255.456501
NtAllocateVirtualMemory
process_identifier: 2288
region_size: 61440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00340000
success 0 0
1620848318.879249
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004150000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a service (1 个事件)
Time & API Arguments Status Return Repeated
1620848267.612501
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x00602990
display_name: rdsangle
error_control: 0
service_name: rdsangle
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\rdsangle.exe"
filepath_r: "C:\Windows\SysWOW64\rdsangle.exe"
service_manager_handle: 0x005fce48
desired_access: 18
service_type: 16
password:
success 6302096 0
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1620848263.299501
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\811f728030be9df8a4b0b7ea33912723.exe
newfilepath: C:\Windows\SysWOW64\rdsangle.exe
newfilepath_r: C:\Windows\SysWOW64\rdsangle.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\811f728030be9df8a4b0b7ea33912723.exe
success 1 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 105.226.188.128
host 172.217.24.14
host 91.205.173.54
Installs itself for autorun at Windows startup (1 个事件)
service_name rdsangle service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\rdsangle.exe"
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\rdsangle.exe:Zone.Identifier
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 105.226.188.128:8090
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
dead_host 91.205.173.54:8080
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-11-15 16:32:47

Imports

Library ADVAPI32.DLL:
• 0x42b080 SetFileSecurityW
Library KERNEL32.DLL:
• 0x42b12c CloseHandle
• 0x42b130 CreateFileA
• 0x42b134 ExitProcess
• 0x42b138 GetACP
• 0x42b13c GetCPInfo
• 0x42b140 GetCommandLineA
• 0x42b144 GetCurrentThreadId
• 0x42b14c GetFileType
• 0x42b150 GetLastError
• 0x42b154 GetLocalTime
• 0x42b158 GetModuleFileNameA
• 0x42b15c GetModuleHandleA
• 0x42b160 GetOEMCP
• 0x42b164 GetProcAddress
• 0x42b168 GetProcessHeap
• 0x42b16c GetStartupInfoA
• 0x42b170 GetStdHandle
• 0x42b174 GetStringTypeW
• 0x42b178 GetVersion
• 0x42b17c GetVersionExA
• 0x42b180 GlobalMemoryStatus
• 0x42b184 HeapAlloc
• 0x42b188 HeapFree
• 0x42b18c LoadLibraryA
• 0x42b190 MultiByteToWideChar
• 0x42b194 RaiseException
• 0x42b198 RtlUnwind
• 0x42b1a0 SetFilePointer
• 0x42b1a4 SetHandleCount
• 0x42b1a8 TlsAlloc
• 0x42b1ac TlsFree
• 0x42b1b0 TlsGetValue
• 0x42b1b4 TlsSetValue
• 0x42b1bc VirtualAlloc
• 0x42b1c0 VirtualFree
• 0x42b1c4 WideCharToMultiByte
• 0x42b1c8 WriteFile
Library GDI32.DLL:
• 0x42b1d8 GetStockObject
Library SHELL32.DLL:
• 0x42b1e8 CommandLineToArgvW
Library USER32.DLL:
• 0x42b23c CreateWindowExA
• 0x42b240 DefWindowProcA
• 0x42b244 DispatchMessageA
• 0x42b248 EnumThreadWindows
• 0x42b24c GetMessageA
• 0x42b250 GetWindowTextA
• 0x42b258 LoadCursorA
• 0x42b25c LoadIconA
• 0x42b260 MessageBoxA
• 0x42b264 PostQuitMessage
• 0x42b268 RegisterClassExA
• 0x42b26c SendDlgItemMessageA
• 0x42b270 SendMessageA
• 0x42b274 SetWindowTextA
• 0x42b278 ShowWindow
• 0x42b27c TranslateMessage
• 0x42b280 wsprintfA

Exports

Ordinal Address Name
1 0x401059 __GetExceptDLLinfo
2 0x410134 ___CPPdebugHook

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60221 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.