SmartHawk

9.2

极危

54 个模型检测该样本为恶意！

重新分析

下载样本

5ac78dea36a7e315ee9c8e9a034169840772aaf84a494db110f43fd403d275eb

81ea6ba2a1670a6f56007565519b3f3b.exe

分析耗时

86s

最近分析

文件大小

870.0KB

静态报毒动态报毒 2M0@A857MDF AGENTTESLA AGNETTESLA AI SCORE=83 ATTRIBUTE BEHAVIOR CLOUD CONFIDENCE EBHA ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE HQHKCM IGENERIC INJECT3 KRYPTIK MALICIOUS PE NONAME@0 PWSX QDDDX R032C0DH420 R346819 SCORE TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:MSIL/AgentTesla.6988b1e8	20190527	0.3.0.5
Avast	Win32:PWSX-gen [Trj]	20200824	18.4.3895.0
Tencent	Msil.Trojan.Crypt.Ebha	20200825	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20200825	2013.8.14.323
McAfee	Fareit-FXO!81EA6BA2A167	20200825	6.0.6.653
CrowdStrike	win/malicious_confidence_70% (W)	20190702	1.0

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619720107.205999 IsDebuggerPresent		failed	0	0
1619720107.205999 IsDebuggerPresent		failed	0	0
1619720153.643999 IsDebuggerPresent		failed	0	0
1619720154.158999 IsDebuggerPresent		failed	0	0
1619720154.394124 IsDebuggerPresent		failed	0	0
1619720154.394124 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619720107.221999 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 123 个事件)

Time & API	Arguments	Status	Return
1619720105.361999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00490000	success	0
1619720105.361999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d0000	success	0
1619720107.033999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00670000	success	0
1619720107.033999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00760000	success	0
1619720107.143999 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619720107.205999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success	0
1619720107.205999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02290000	success	0
1619720107.205999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success	0
1619720107.205999 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619720107.205999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00522000	success	0
1619720107.424999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success	0
1619720107.518999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00555000	success	0
1619720107.518999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055b000	success	0
1619720107.518999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00557000	success	0
1619720107.674999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00533000	success	0
1619720107.705999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053c000	success	0
1619720108.408999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00534000	success	0
1619720108.424999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success	0
1619720108.549999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d0000	success	0
1619720108.846999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052c000	success	0
1619720108.846999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success	0
1619720108.846999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00523000	success	0
1619720108.940999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00538000	success	0
1619720108.986999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00539000	success	0
1619720109.018999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00546000	success	0
1619720109.033999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00980000	success	0
1619720109.049999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success	0
1619720109.049999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success	0
1619720109.049999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d1000	success	0
1619720109.065999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00981000	success	0
1619720109.080999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d2000	success	0
1619720109.096999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d5000	success	0
1619720150.111999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d6000	success	0
1619720150.565999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d7000	success	0
1619720150.674999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00982000	success	0
1619720150.690999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053d000	success	0
1619720150.690999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00983000	success	0
1619720150.690999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d8000	success	0
1619720150.690999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008d9000	success	0
1619720150.893999 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 334848 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05230400	failed	3221225550
1619720153.299999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008da000	success	0
1619720153.299999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008db000	success	0
1619720153.315999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00984000	success	0
1619720153.315999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008dc000	success	0
1619720153.330999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008dd000	success	0
1619720153.330999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008de000	success	0
1619720153.486999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008df000	success	0
1619720153.533999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc0000	success	0
1619720153.533999 NtAllocateVirtualMemory	process_identifier: 2504 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc1000	success	0
1619720153.533999 NtProtectVirtualMemory	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05230178	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.54691914371517

section

{'size_of_data': '0x000d8e00', 'virtual_address': '0x00002000', 'entropy': 7.54691914371517, 'name': '.text', 'virtual_size': '0x000d8cb8'}

description

A section with a high entropy has been found

entropy

0.9976998274870615

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619720150.877999 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619720154.158999 NtAllocateVirtualMemory	process_identifier: 2576 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00002d30 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619720154.158999 WriteProcessMemory	process_identifier: 2576 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYÝ_àP^o @ À@oK H.textdO P `.rsrc R@@.reloc V@B process_handle: 0x00002d30 base_address: 0x00400000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: 0HXÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNameGVFjQUTTuTfDoTTuHMELaPEnkkYTASNGXUmhpgG.exe(LegalCopyright ,OriginalFilenameGVFjQUTTuTfDoTTuHMELaPEnkkYTASNGXUmhpgG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00002d30 base_address: 0x00448000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: ``? process_handle: 0x00002d30 base_address: 0x0044a000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: @ process_handle: 0x00002d30 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619720154.158999 WriteProcessMemory	process_identifier: 2576 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYÝ_àP^o @ À@oK H.textdO P `.rsrc R@@.reloc V@B process_handle: 0x00002d30 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2504 called NtSetContextThread to modify thread in remote process 2576
1619720154.174999 NtSetContextThread	thread_handle: 0x00005104 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484958 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2576	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2504 resumed a thread in remote process 2576
1619720154.221999 NtResumeThread	thread_handle: 0x00005104 suspend_count: 1 process_identifier: 2576	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619720107.205999 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2504	success	0
1619720107.221999 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2504	success	0
1619720107.221999 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2504	success	0
1619720153.627999 NtResumeThread	thread_handle: 0x0000b470 suspend_count: 1 process_identifier: 2504	success	0
1619720153.627999 NtResumeThread	thread_handle: 0x00004a1c suspend_count: 1 process_identifier: 2504	success	0
1619720154.158999 CreateProcessInternalW	thread_identifier: 952 thread_handle: 0x00005104 process_identifier: 2576 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00002d30 inherit_handles: 0	success	1
1619720154.158999 NtGetContextThread	thread_handle: 0x00005104	success	0
1619720154.158999 NtAllocateVirtualMemory	process_identifier: 2576 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00002d30 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619720154.158999 WriteProcessMemory	process_identifier: 2576 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELYÝ_àP^o @ À@oK H.textdO P `.rsrc R@@.reloc V@B process_handle: 0x00002d30 base_address: 0x00400000	success	1
1619720154.158999 WriteProcessMemory	process_identifier: 2576 buffer: process_handle: 0x00002d30 base_address: 0x00402000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: 0HXÄÄ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°$StringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0x,InternalNameGVFjQUTTuTfDoTTuHMELaPEnkkYTASNGXUmhpgG.exe(LegalCopyright ,OriginalFilenameGVFjQUTTuTfDoTTuHMELaPEnkkYTASNGXUmhpgG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00002d30 base_address: 0x00448000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: ``? process_handle: 0x00002d30 base_address: 0x0044a000	success	1
1619720154.174999 WriteProcessMemory	process_identifier: 2576 buffer: @ process_handle: 0x00002d30 base_address: 0x7efde008	success	1
1619720154.174999 NtSetContextThread	thread_handle: 0x00005104 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484958 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2576	success	0
1619720154.221999 NtResumeThread	thread_handle: 0x00005104 suspend_count: 1 process_identifier: 2576	success	0
1619720154.394124 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2576	success	0
1619720154.409124 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2576	success	0
1619720154.409124 NtResumeThread	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2576	success	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.Inject3.48221
MicroWorld-eScan	Trojan.GenericKD.34283938
FireEye	Trojan.GenericKD.34283938
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.GenericKD.34283938
Cylance	Unsafe
Zillya	Trojan.Crypt.Win32.64698
Sangfor	Malware
K7AntiVirus	Trojan ( 0056bec11 )
Alibaba	Trojan:MSIL/AgentTesla.6988b1e8
K7GW	Trojan ( 0056bec11 )
Cybereason	malicious.fd93c4
Arcabit	Trojan.Generic.D20B21A2
TrendMicro	TROJ_GEN.R032C0DH420
BitDefenderTheta	Gen:NN.ZemsilF.34196.2m0@a857mdf
Cyren	W32/MSIL_Kryptik.BHF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34283938
NANO-Antivirus	Trojan.Win32.Crypt.hqhkcm
ViRobot	Trojan.Win32.Z.Agent.890880.AI
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan.Crypt.Ebha
Ad-Aware	Trojan.GenericKD.34283938
Emsisoft	Trojan.GenericKD.34283938 (B)
Comodo	fls.noname@0
F-Secure	Trojan.TR/Kryptik.qdddx
VIPRE	Trojan.Win32.Generic!BT
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
eGambit	Unsafe.AI_Score_96%
Avira	TR/Kryptik.qdddx
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:MSIL/AgentTesla.I!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.34283938
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Kryptik.R346819
McAfee	Fareit-FXO!81EA6BA2A167
MAX	malware (ai score=83)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XEO
TrendMicro-HouseCall	TROJ_GEN.R032C0DH420
Rising	Trojan.AgnetTesla!8.11EC9 (CLOUD)
Ikarus	Trojan.MSIL.Inject
Fortinet	Malicious_Behavior.SB

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-03 23:07:55

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.