SmartHawk

13.2

0-day

47 个模型检测该样本为恶意！

重新分析

下载样本

c90e8c00718440709f2a708d2144adb877b2908b024e7a94bc20b4f9eb0ee92c

81cc6cad17b05f8f3fe42d96096ad63a.exe

分析耗时

100s

最近分析

文件大小

446.0KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=89 AVSARHER BTQUDW CONFIDENCE ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE KRYPT KRYPTIK MALICIOUS PE MALWARE@#29MXQMUOC7NU8 NANOCORE R339403 SCORE STATIC AI SUSGEN TROJANPSW UNSAFE WULLJ YAKBEEXMSIL 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanPSW:MSIL/Nanocore.7b39c67c	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201210	21.1.5827.0
Tencent		20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
McAfee	Fareit-FTN!81CC6CAD17B0	20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_70% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619686002.437 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619706740.8365 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619706744.0715 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685964.328 IsDebuggerPresent		failed	0	0
1619706709.8675 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686001.187 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 个事件)

Time & API	Arguments	Status
1619685963.172 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00540000	success
1619685963.172 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a0000	success
1619685964.203 NtProtectVirtualMemory	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619685964.328 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success
1619685964.328 NtProtectVirtualMemory	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619685964.328 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success
1619685964.656 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success
1619685964.734 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00433000	success
1619685964.765 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056b000	success
1619685964.765 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00567000	success
1619685964.797 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043c000	success
1619685965.422 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00434000	success
1619685965.422 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00435000	success
1619685965.484 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00436000	success
1619685965.515 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa0000	success
1619685965.625 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success
1619685965.625 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success
1619685965.656 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619685965.687 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042b000	success
1619685966.781 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00546000	success
1619685966.875 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x04930000	success
1619685966.875 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b0000	success
1619685966.875 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b1000	success
1619685966.906 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b2000	success
1619685966.937 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success
1619685966.953 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa1000	success
1619685966.984 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b3000	success
1619685966.984 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b4000	success
1619685967.031 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b5000	success
1619685967.047 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa2000	success
1619685967.062 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1619685967.172 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success
1619685967.218 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00565000	success
1619685967.39 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b80000	success
1619686000.703 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a1000	success
1619686000.89 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00438000	success
1619686001.109 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa3000	success
1619686001.109 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049b6000	success
1619686001.109 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049ba000	success
1619686001.109 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049cb000	success
1619686001.125 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049cc000	success
1619686001.14 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049cd000	success
1619686001.156 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00439000	success
1619686001.156 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa4000	success
1619686001.156 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049ce000	success
1619686001.156 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049cf000	success
1619686001.172 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049d0000	success
1619686001.172 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa5000	success
1619686002.0 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa6000	success
1619686002.047 NtAllocateVirtualMemory	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00423000	success

Executes one or more WMI queries (1 个事件)

wmi	SELECT * FROM Win32_VideoController

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.784750669883132

section

{'size_of_data': '0x0006ee00', 'virtual_address': '0x00002000', 'entropy': 7.784750669883132, 'name': '.text', 'virtual_size': '0x0006ec4c'}

description

A section with a high entropy has been found

entropy

0.9955106621773289

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619706710.3365 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619706740.7895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2136 process_handle: 0x00000220	failed	0	0
1619706740.7895 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2136 process_handle: 0x00000220	success	0	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.40.34
host	203.208.41.65

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686003.078 NtAllocateVirtualMemory	process_identifier: 176 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000364 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619686003.078 WriteProcessMemory	process_identifier: 176 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELH^à¨ À@ @È§SÀèà H.text$ `.rsrcèÀ@@.relocà@B process_handle: 0x00000364 base_address: 0x00400000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: 0HXÀ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNamelaPwsgjAbeLmGdmRHOItRPpMz.exe(LegalCopyright dOriginalFilenamelaPwsgjAbeLmGdmRHOItRPpMz.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00000364 base_address: 0x0044c000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: 8 process_handle: 0x00000364 base_address: 0x0044e000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: @ process_handle: 0x00000364 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686003.078 WriteProcessMemory	process_identifier: 176 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELH^à¨ À@ @È§SÀèà H.text$ `.rsrcèÀ@@.relocà@B process_handle: 0x00000364 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2136 called NtSetContextThread to modify thread in remote process 176
1619686003.093 NtSetContextThread	thread_handle: 0x00000360 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4499486 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 176	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2136 resumed a thread in remote process 176
1619686003.172 NtResumeThread	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 176	success	0	0

Detects VirtualBox through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686002.031 LdrGetProcedureAddress	ordinal: 0 module: KERNEL32 module_address: 0x76340000 function_address: 0x003cdf78 function_name: wine_get_unix_file_name	failed	3221225785	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619685964.328 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2136	success	0
1619685964.39 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2136	success	0
1619686002.031 NtResumeThread	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2136	success	0
1619686002.234 NtResumeThread	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2136	success	0
1619686003.078 CreateProcessInternalW	thread_identifier: 2008 thread_handle: 0x00000360 process_identifier: 176 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\81cc6cad17b05f8f3fe42d96096ad63a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\81cc6cad17b05f8f3fe42d96096ad63a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000364 inherit_handles: 0	success	1
1619686003.078 NtGetContextThread	thread_handle: 0x00000360	success	0
1619686003.078 NtAllocateVirtualMemory	process_identifier: 176 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000364 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619686003.078 WriteProcessMemory	process_identifier: 176 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELH^à¨ À@ @È§SÀèà H.text$ `.rsrcèÀ@@.relocà@B process_handle: 0x00000364 base_address: 0x00400000	success	1
1619686003.078 WriteProcessMemory	process_identifier: 176 buffer: process_handle: 0x00000364 base_address: 0x00402000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: 0HXÀ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNamelaPwsgjAbeLmGdmRHOItRPpMz.exe(LegalCopyright dOriginalFilenamelaPwsgjAbeLmGdmRHOItRPpMz.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00000364 base_address: 0x0044c000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: 8 process_handle: 0x00000364 base_address: 0x0044e000	success	1
1619686003.093 WriteProcessMemory	process_identifier: 176 buffer: @ process_handle: 0x00000364 base_address: 0x7efde008	success	1
1619686003.093 NtSetContextThread	thread_handle: 0x00000360 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4499486 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 176	success	0
1619686003.172 NtResumeThread	thread_handle: 0x00000360 suspend_count: 1 process_identifier: 176	success	0
1619706709.8675 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 176	success	0
1619706709.8835 NtResumeThread	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 176	success	0
1619706743.9925 NtResumeThread	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 176	success	0
1619706743.9925 NtResumeThread	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 176	success	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43283054
FireEye	Generic.mg.81cc6cad17b05f8f
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKD.43283054
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005636e21 )
Alibaba	TrojanPSW:MSIL/Nanocore.7b39c67c
K7GW	Trojan ( 005636e21 )
Cybereason	malicious.6eb8b2
Arcabit	Trojan.Generic.D294726E
Cyren	W32/MSIL_Kryptik.ALK.gen!Eldorado
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.43283054
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.43283054
Sophos	Mal/Generic-S
Comodo	Malware@#29mxqmuoc7nu8
F-Secure	Trojan.TR/Kryptik.wullj
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Emsisoft	Trojan.GenericKD.43283054 (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/Kryptik.wullj
MAX	malware (ai score=89)
Gridinsoft	Trojan.Win32.Kryptik.dd!ni
Microsoft	Trojan:MSIL/Nanocore.PRB!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.43283054
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R339403
McAfee	Fareit-FTN!81CC6CAD17B0
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.VFR
Yandex	Trojan.AvsArher.bTQUdW
Ikarus	Trojan.MSIL.Krypt
MaxSecure	Trojan.Malware.74499699.susgen
Fortinet	MSIL/Kryptik.VFR!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (W)
Qihoo-360	Generic/Trojan.PSW.374

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-04 11:54:07

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.