SmartHawk

8.6

极危

54 个模型检测该样本为恶意！

重新分析

下载样本

d17e7aae62fd256c264b2602f913c5b918501a1416abb5c58a4f14bcafa2b0d6

821b0e70a2b51999a55f15a38e6d8ca4.exe

分析耗时

46s

最近分析

文件大小

995.5KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=86 BTIOQQ CLOUD CONFIDENCE FAREIT GDSDA GENCIRC GENERICKD GENKRYPTIK HIGH CONFIDENCE IGENT JWEIC KRYPTIK MALICIOUS MALICIOUS PE MALWARE@#3MFTAYM6JE0 PCRYPT PWSX R011C0DEC20 R336115 SCORE SIGGEN2 TSCOPE UNSAFE YAKBEEXMSIL ZDBZ 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTE!821B0E70A2B5	20200710	6.0.6.653
Alibaba	TrojanSpy:MSIL/AgentTesla.06cf9363	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20200710	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cdd64b	20200710	1.0.0.1
Kingsoft		20200710	2013.8.14.323
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692086.836249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692081.429501 IsDebuggerPresent		failed	0	0
1619692081.429501 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692096.398249 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\HuxzEmPpQT"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692081.444501 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (49 个事件)

Time & API	Arguments	Status
1619692080.507501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00800000	success
1619692080.507501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b0000	success
1619692081.304501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01df0000	success
1619692081.304501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f30000	success
1619692081.335501 NtProtectVirtualMemory	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619692081.429501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01e40000	success
1619692081.429501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb0000	success
1619692081.444501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009aa000	success
1619692081.444501 NtProtectVirtualMemory	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619692081.444501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a2000	success
1619692081.663501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df2000	success
1619692081.757501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e15000	success
1619692081.772501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e1b000	success
1619692081.772501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e17000	success
1619692081.897501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df3000	success
1619692081.929501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01dfc000	success
1619692082.710501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df4000	success
1619692082.710501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df6000	success
1619692082.835501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f70000	success
1619692082.991501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df7000	success
1619692083.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e0a000	success
1619692083.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e07000	success
1619692083.632501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e06000	success
1619692083.882501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01dfa000	success
1619692084.101501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f71000	success
1619692084.304501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df8000	success
1619692084.522501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f31000	success
1619692084.882501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01df9000	success
1619692084.976501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04240000	success
1619692084.976501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04241000	success
1619692084.991501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb1000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb2000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb3000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb4000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb5000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01eb8000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ebc000	success
1619692085.007501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ecd000	success
1619692085.022501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04242000	success
1619692085.101501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f72000	success
1619692085.101501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ece000	success
1619692085.101501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ecf000	success
1619692085.116501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f73000	success
1619692085.132501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ed0000	success
1619692085.179501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f74000	success
1619692085.210501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04243000	success
1619692085.272501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f75000	success
1619692097.397501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f76000	success
1619692097.851501 NtAllocateVirtualMemory	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009a3000	success

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp"
cmdline	schtasks.exe /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692086.491501 ShellExecuteExW	parameters: /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.848829556322726

section

{'size_of_data': '0x000df400', 'virtual_address': '0x00002000', 'entropy': 7.848829556322726, 'name': '.text', 'virtual_size': '0x000df310'}

description

A section with a high entropy has been found

entropy

0.8974874371859296

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619692097.491501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619692097.601501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x00000394	failed
1619692097.601501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2968 process_handle: 0x00000394	success
1619692097.632501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 284 process_handle: 0x0000039c	failed
1619692097.632501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 284 process_handle: 0x0000039c	success
1619692097.679501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1056 process_handle: 0x000003a4	failed
1619692097.679501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1056 process_handle: 0x000003a4	success
1619692097.757501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x000003ac	failed
1619692097.757501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2144 process_handle: 0x000003ac	success
1619692097.804501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2008 process_handle: 0x000003b4	failed
1619692097.804501 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2008 process_handle: 0x000003b4	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp"
cmdline	schtasks.exe /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619692097.460501 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000038c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.601501 NtAllocateVirtualMemory	process_identifier: 284 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000390 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.647501 NtAllocateVirtualMemory	process_identifier: 1056 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.694501 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.772501 NtAllocateVirtualMemory	process_identifier: 2008 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3004 manipulating memory of non-child process 2968
Process injection	Process 3004 manipulating memory of non-child process 284
Process injection	Process 3004 manipulating memory of non-child process 1056
Process injection	Process 3004 manipulating memory of non-child process 2144
Process injection	Process 3004 manipulating memory of non-child process 2008
1619692097.460501 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000038c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619692097.601501 NtAllocateVirtualMemory	process_identifier: 284 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000390 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619692097.647501 NtAllocateVirtualMemory	process_identifier: 1056 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619692097.694501 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619692097.772501 NtAllocateVirtualMemory	process_identifier: 2008 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619692081.429501 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 3004	success	0
1619692081.444501 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 3004	success	0
1619692081.460501 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 3004	success	0
1619692086.491501 CreateProcessInternalW	thread_identifier: 1888 thread_handle: 0x0000033c process_identifier: 1948 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HuxzEmPpQT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp872C.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000374 inherit_handles: 0	success	1
1619692097.460501 CreateProcessInternalW	thread_identifier: 2944 thread_handle: 0x00000330 process_identifier: 2968 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000038c inherit_handles: 0	success	1
1619692097.460501 NtGetContextThread	thread_handle: 0x00000330	success	0
1619692097.460501 NtAllocateVirtualMemory	process_identifier: 2968 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000038c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.601501 CreateProcessInternalW	thread_identifier: 2548 thread_handle: 0x00000394 process_identifier: 284 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000390 inherit_handles: 0	success	1
1619692097.601501 NtGetContextThread	thread_handle: 0x00000394	success	0
1619692097.601501 NtAllocateVirtualMemory	process_identifier: 284 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000390 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.647501 CreateProcessInternalW	thread_identifier: 1824 thread_handle: 0x0000039c process_identifier: 1056 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000398 inherit_handles: 0	success	1
1619692097.647501 NtGetContextThread	thread_handle: 0x0000039c	success	0
1619692097.647501 NtAllocateVirtualMemory	process_identifier: 1056 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.694501 CreateProcessInternalW	thread_identifier: 324 thread_handle: 0x000003a4 process_identifier: 2144 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a0 inherit_handles: 0	success	1
1619692097.694501 NtGetContextThread	thread_handle: 0x000003a4	success	0
1619692097.694501 NtAllocateVirtualMemory	process_identifier: 2144 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619692097.772501 CreateProcessInternalW	thread_identifier: 1940 thread_handle: 0x000003ac process_identifier: 2008 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\821b0e70a2b51999a55f15a38e6d8ca4.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a8 inherit_handles: 0	success	1
1619692097.772501 NtGetContextThread	thread_handle: 0x000003ac	success	0
1619692097.772501 NtAllocateVirtualMemory	process_identifier: 2008 region_size: 679936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

FireEye	Generic.mg.821b0e70a2b51999
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FTE!821B0E70A2B5
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2035430
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:MSIL/AgentTesla.06cf9363
K7GW	Riskware ( 0040eff71 )
TrendMicro	TROJ_GEN.R011C0DEC20
F-Prot	W32/Fareit.DLP
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Cynet	Malicious (score: 85)
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.43142352
Paloalto	generic.ml
MicroWorld-eScan	Trojan.GenericKD.43142352
Tencent	Malware.Win32.Gencirc.10cdd64b
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.43142352 (B)
Comodo	Malware@#3mftaym6je0
F-Secure	Trojan.TR/Kryptik.jweic
DrWeb	Trojan.PWS.Siggen2.48635
VIPRE	Trojan.Win32.Generic!BT
Sophos	Mal/MSIL-UJ
SentinelOne	DFI - Malicious PE
Cyren	W32/Fareit.ZDBZ-6009
Jiangmin	Trojan.PSW.MSIL.zcy
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.jweic
Fortinet	MSIL/Kryptik.VVH!tr
Antiy-AVL	Trojan[PSW]/MSIL.Agensla
Microsoft	TrojanSpy:MSIL/AgentTesla.AP!MTB
Arcabit	Trojan.Generic.D2924CD0
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.43142352
AhnLab-V3	Trojan/Win32.Kryptik.R336115
ALYac	Trojan.GenericKD.43142352
MAX	malware (ai score=86)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.PCrypt.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.VVH
TrendMicro-HouseCall	TROJ_GEN.R011C0DEC20
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Yandex	Trojan.Igent.bTIoqQ.27
Ikarus	Trojan.MSIL.Inject
Ad-Aware	Trojan.GenericKD.43142352

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2097-10-05 00:16:50

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.