11.4
0-day
28 个模型检测该样本为恶意！
重新分析
更多

e7bd0a2c83baca8fac289c1b43a3922ba487b2e7eddb13d82e584d6bdc0086b2

84e1cb63f8b14e90fd69c537525e52bd.exe

分析耗时

110s

最近分析

文件大小

904.0KB
静态报毒 动态报毒 100% AGENTTESLA CONFIDENCE DYSGZE ECKF GENERICKD HIGH CONFIDENCE KCLOUD KRYPTIK MALICIOUS PE MSILINJECT NEGASTEAL R351005 SCORE SPVDO STATIC AI TSCOPE UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
Baidu 20190318 1.0.0.2
Alibaba Trojan:MSIL/AgentTesla.ef078089 20190527 0.3.0.5
Kingsoft Win32.Troj.Undef.(kcloud) 20210507 2017.9.26.565
Tencent Msil.Trojan.Crypt.Eckf 20210507 1.0.0.1
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620950955.961751
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (20 个事件)
Time & API Arguments Status Return Repeated
1620950897.758501
IsDebuggerPresent
failed 0 0
1620950897.758501
IsDebuggerPresent
failed 0 0
1620950954.148501
IsDebuggerPresent
failed 0 0
1620950954.648501
IsDebuggerPresent
failed 0 0
1620950955.148501
IsDebuggerPresent
failed 0 0
1620950955.648501
IsDebuggerPresent
failed 0 0
1620950956.195501
IsDebuggerPresent
failed 0 0
1620950956.648501
IsDebuggerPresent
failed 0 0
1620950957.211501
IsDebuggerPresent
failed 0 0
1620950957.664501
IsDebuggerPresent
failed 0 0
1620950958.211501
IsDebuggerPresent
failed 0 0
1620950958.664501
IsDebuggerPresent
failed 0 0
1620950959.211501
IsDebuggerPresent
failed 0 0
1620950959.664501
IsDebuggerPresent
failed 0 0
1620950960.227501
IsDebuggerPresent
failed 0 0
1620950960.664501
IsDebuggerPresent
failed 0 0
1620950961.242501
IsDebuggerPresent
failed 0 0
1620950961.680501
IsDebuggerPresent
failed 0 0
1620950962.382999
IsDebuggerPresent
failed 0 0
1620950962.382999
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1620950958.086751
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\HFTyIVpPDTQyP"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620950897.836501
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 125 个事件)
Time & API Arguments Status Return Repeated
1620950896.273501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x004e0000
success 0 0
1620950896.273501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004e0000
success 0 0
1620950897.133501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02030000
success 0 0
1620950897.133501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02180000
success 0 0
1620950897.320501
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1620950897.758501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00620000
success 0 0
1620950897.758501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00640000
success 0 0
1620950897.758501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055a000
success 0 0
1620950897.758501
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1620950897.758501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00552000
success 0 0
1620950898.477501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00562000
success 0 0
1620950899.008501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00585000
success 0 0
1620950899.023501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058b000
success 0 0
1620950899.023501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1620950899.539501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00563000
success 0 0
1620950899.664501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056c000
success 0 0
1620950900.711501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00564000
success 0 0
1620950900.727501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00566000
success 0 0
1620950900.992501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00700000
success 0 0
1620950901.242501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00567000
success 0 0
1620950901.320501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057a000
success 0 0
1620950901.320501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00577000
success 0 0
1620950901.789501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00701000
success 0 0
1620950902.008501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00576000
success 0 0
1620950902.648501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055c000
success 0 0
1620950903.758501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056a000
success 0 0
1620950904.008501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00568000
success 0 0
1620950904.883501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057b000
success 0 0
1620950938.258501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02181000
success 0 0
1620950938.492501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00703000
success 0 0
1620950938.508501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00553000
success 0 0
1620950938.602501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00569000
success 0 0
1620950938.664501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04380000
success 0 0
1620950938.664501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04381000
success 0 0
1620950938.742501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04382000
success 0 0
1620950938.789501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00704000
success 0 0
1620950938.820501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04383000
success 0 0
1620950938.836501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00705000
success 0 0
1620950938.867501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00708000
success 0 0
1620950939.023501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056d000
success 0 0
1620950939.023501
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 368128
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05730400
failed 3221225550 0
1620950953.414501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00709000
success 0 0
1620950953.414501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04384000
success 0 0
1620950953.430501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070a000
success 0 0
1620950953.508501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070b000
success 0 0
1620950953.508501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070c000
success 0 0
1620950953.539501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070d000
success 0 0
1620950953.633501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070e000
success 0 0
1620950953.695501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02090000
success 0 0
1620950953.695501
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02091000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\HFTyIVpPDTQyP.exe
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\HFTyIVpPDTQyP.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1620950955.477501
ShellExecuteExW
parameters: /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.104969302636386 section {'size_of_data': '0x000e1400', 'virtual_address': '0x00002000', 'entropy': 7.104969302636386, 'name': '.text', 'virtual_size': '0x000e13f4'} description A section with a high entropy has been found
entropy 0.9972329828444937 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1620950939.008501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620950975.976999
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 104.26.9.53
host 172.217.24.14
host 52.218.98.12
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1620950961.273501
NtAllocateVirtualMemory
process_identifier: 1344
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000079f8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1620950961.273501
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl®"_à  ZÞx €@ À@…„xW€Ø   H.textäX Z `.rsrcØ€\@@.reloc  b@B
process_handle: 0x000079f8
base_address: 0x00400000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer:  €P€8€€h€ €LìƒêL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfoˆ000004b0 CommentsHi(CompanyNameHi0FileDescriptionHi,FileVersion1.4.8l%InternalNameKwzBhuSBSXhOMdRfZEwqxbbUarWyMLgW.exe,LegalCopyrightHi0LegalTrademarksHit%OriginalFilenameKwzBhuSBSXhOMdRfZEwqxbbUarWyMLgW.exe(ProductNameHi0ProductVersion1.4.88Assembly Version1.4.8.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x000079f8
base_address: 0x00448000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer: p à8
process_handle: 0x000079f8
base_address: 0x0044a000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer: @
process_handle: 0x000079f8
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1620950961.273501
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl®"_à  ZÞx €@ À@…„xW€Ø   H.textäX Z `.rsrcØ€\@@.reloc  b@B
process_handle: 0x000079f8
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2284 called NtSetContextThread to modify thread in remote process 1344
Time & API Arguments Status Return Repeated
1620950961.305501
NtSetContextThread
thread_handle: 0x00010ebc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4487390
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1344
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2284 resumed a thread in remote process 1344
Time & API Arguments Status Return Repeated
1620950961.898501
NtResumeThread
thread_handle: 0x00010ebc
suspend_count: 1
process_identifier: 1344
success 0 0
File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34506424
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2527171
CrowdStrike win/malicious_confidence_100% (W)
K7GW Trojan ( 0056e2561 )
K7AntiVirus Trojan ( 0056e2561 )
APEX Malicious
Paloalto generic.ml
Alibaba Trojan:MSIL/AgentTesla.ef078089
Ad-Aware Trojan.GenericKD.34506424
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.MSIL.NEGASTEAL.DYSGZE
Emsisoft Trojan.Crypt (A)
Ikarus Trojan.MSIL.Inject
Avira TR/Dropper.MSIL.spvdo
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Trojan:MSIL/AgentTesla!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.MSILInject.R351005
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.MalPack
TrendMicro-HouseCall TrojanSpy.MSIL.NEGASTEAL.DYSGZE
Tencent Msil.Trojan.Crypt.Eckf
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Kryptik.XSF!tr
Cybereason malicious.3f8b14
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
Executed a process and injected code into it, probably while unpacking (23 个事件)
Time & API Arguments Status Return Repeated
1620950897.758501
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2284
success 0 0
1620950897.773501
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 2284
success 0 0
1620950897.930501
NtResumeThread
thread_handle: 0x0000016c
suspend_count: 1
process_identifier: 2284
success 0 0
1620950954.070501
NtResumeThread
thread_handle: 0x0000c554
suspend_count: 1
process_identifier: 2284
success 0 0
1620950954.102501
NtResumeThread
thread_handle: 0x000075e8
suspend_count: 1
process_identifier: 2284
success 0 0
1620950955.461501
CreateProcessInternalW
thread_identifier: 1236
thread_handle: 0x00004190
process_identifier: 2248
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HFTyIVpPDTQyP" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4F6E.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x0000400c
inherit_handles: 0
success 1 0
1620950961.258501
CreateProcessInternalW
thread_identifier: 2576
thread_handle: 0x00010ebc
process_identifier: 1344
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\84e1cb63f8b14e90fd69c537525e52bd.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\84e1cb63f8b14e90fd69c537525e52bd.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000079f8
inherit_handles: 0
success 1 0
1620950961.258501
NtGetContextThread
thread_handle: 0x00010ebc
success 0 0
1620950961.273501
NtAllocateVirtualMemory
process_identifier: 1344
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000079f8
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1620950961.273501
WriteProcessMemory
process_identifier: 1344
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELl®"_à  ZÞx €@ À@…„xW€Ø   H.textäX Z `.rsrcØ€\@@.reloc  b@B
process_handle: 0x000079f8
base_address: 0x00400000
success 1 0
1620950961.273501
WriteProcessMemory
process_identifier: 1344
buffer:
process_handle: 0x000079f8
base_address: 0x00402000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer:  €P€8€€h€ €LìƒêL4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¬StringFileInfoˆ000004b0 CommentsHi(CompanyNameHi0FileDescriptionHi,FileVersion1.4.8l%InternalNameKwzBhuSBSXhOMdRfZEwqxbbUarWyMLgW.exe,LegalCopyrightHi0LegalTrademarksHit%OriginalFilenameKwzBhuSBSXhOMdRfZEwqxbbUarWyMLgW.exe(ProductNameHi0ProductVersion1.4.88Assembly Version1.4.8.0<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly>
process_handle: 0x000079f8
base_address: 0x00448000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer: p à8
process_handle: 0x000079f8
base_address: 0x0044a000
success 1 0
1620950961.305501
WriteProcessMemory
process_identifier: 1344
buffer: @
process_handle: 0x000079f8
base_address: 0x7efde008
success 1 0
1620950961.305501
NtSetContextThread
thread_handle: 0x00010ebc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4487390
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1344
success 0 0
1620950961.898501
NtResumeThread
thread_handle: 0x00010ebc
suspend_count: 1
process_identifier: 1344
success 0 0
1620950961.898501
NtResumeThread
thread_handle: 0x00004514
suspend_count: 1
process_identifier: 2284
success 0 0
1620950961.992501
NtGetContextThread
thread_handle: 0x00004514
success 0 0
1620950961.992501
NtGetContextThread
thread_handle: 0x00004514
success 0 0
1620950961.992501
NtResumeThread
thread_handle: 0x00004514
suspend_count: 1
process_identifier: 2284
success 0 0
1620950962.382999
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1344
success 0 0
1620950962.397999
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 1344
success 0 0
1620950962.522999
NtResumeThread
thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 1344
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-11 09:31:26

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
104.26.9.53 443 192.168.56.101 49186
52.218.98.12 80 192.168.56.101 49181

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53238 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.