SmartHawk

16.2

0-day

56 个模型检测该样本为恶意！

重新分析

下载样本

286add28a79440668077a7d762ee81ee169f1c08daa27bc680dbf8c8832d2785

86bb43248e3ad56e9a839cc6c7b03282.exe

分析耗时

89s

最近分析

文件大小

339.0KB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=81 ASLG ATBIU AVSARHER BSK66A CONFIDENCE ECAT ELDORADO FORMBO FORMBOOK GDSDA HIGH CONFIDENCE HKDJOM KRYPTIK MALICIOUS PE MALWARE@#2B04UPCIAG7B2 MSILRANDOMKRYPT NOON PACKEDNET PWSX R + TROJ R06EC0DID20 R335607 REMCOS SCORE STATIC AI SUSGEN SWOTTER TSCOPE UNSAFE VENDETTA VM0@A8JGE0N YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:Win32/AgentTesla.57631b2b	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201228	21.1.5827.0
Tencent	Msil.Trojan-spy.Noon.Ecat	20201228	1.0.0.1
Kingsoft		20201228	2017.9.26.565
McAfee	Generic .lx	20201228	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (7 个事件)

Time & API	Arguments	Status	Return
1619691247.12025 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619691225.1515 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619691225.1675 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619691225.1825 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619691225.1825 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619691228.4795 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619691228.4795 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691187.32325 IsDebuggerPresent		failed	0	0
1619691225.3545 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (50 out of 64 个事件)

Time & API	Arguments	Status	Return
1619691226.0265 CryptExportKey	crypto_handle: 0x0045a068 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9175 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9175 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9175 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9325 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9325 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9325 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9635 CryptExportKey	crypto_handle: 0x00459f28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9955 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691226.9955 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.0265 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.0265 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.0265 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.0425 CryptExportKey	crypto_handle: 0x00459468 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5105 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5105 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5105 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5265 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5265 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5265 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691227.5885 CryptExportKey	crypto_handle: 0x004599a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2295 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2295 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2295 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x004598a8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2455 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2765 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.2765 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3235 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3235 CryptExportKey	crypto_handle: 0x00459d68 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3705 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.3855 CryptExportKey	crypto_handle: 0x00459ca8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.4325 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691228.4325 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9015 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9015 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9015 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9015 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9015 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9175 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619691229.9175 CryptExportKey	crypto_handle: 0x00459328 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691224.3705 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 200 个事件)

Time & API	Arguments	Status
1619691186.71325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00770000	success
1619691186.71325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f0000	success
1619691187.26025 NtProtectVirtualMemory	process_identifier: 2996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619691187.32325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619691187.32325 NtProtectVirtualMemory	process_identifier: 2996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619691187.32325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success
1619691187.58825 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619691187.65125 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success
1619691187.66725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success
1619691187.66725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619691187.69825 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success
1619691188.30725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00564000	success
1619691188.30725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00565000	success
1619691188.33825 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00566000	success
1619691188.35425 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00880000	success
1619691188.43225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057a000	success
1619691188.43225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00577000	success
1619691188.43225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success
1619691188.47925 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055b000	success
1619691188.60425 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00576000	success
1619691188.62025 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success
1619691188.99525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00940000	success
1619691189.07325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00881000	success
1619691189.44825 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00582000	success
1619691189.49525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00595000	success
1619691189.68225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f1000	success
1619691189.85425 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00567000	success
1619691189.93225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x04c50000	success
1619691189.93225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d20000	success
1619691189.93225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d21000	success
1619691190.79225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d22000	success
1619691191.10425 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d23000	success
1619691191.12025 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d24000	success
1619691191.16725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d25000	success
1619691191.16725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d26000	success
1619691191.24525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d29000	success
1619691191.24525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d2d000	success
1619691191.24525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d3e000	success
1619691191.33825 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00882000	success
1619691191.47925 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00568000	success
1619691192.21325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d3f000	success
1619691192.21325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d40000	success
1619691192.21325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00883000	success
1619691192.49525 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04d41000	success
1619691192.85425 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00884000	success
1619691223.71325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00941000	success
1619691245.57325 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00885000	success
1619691245.79225 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00553000	success
1619691245.80725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success
1619691245.80725 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 个事件)

cmdline

"powershell" Get-MpPreference -verbose

Executes one or more WMI queries (1 个事件)

wmi	SELECT * FROM Win32_VideoController

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691223.88525 CreateProcessInternalW	thread_identifier: 3036 thread_handle: 0x0000022c process_identifier: 1124 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000238 inherit_handles: 1	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.496615814610849

section

{'size_of_data': '0x00054200', 'virtual_address': '0x00002000', 'entropy': 7.496615814610849, 'name': '.text', 'virtual_size': '0x000541ec'}

description

A section with a high entropy has been found

entropy

0.9940915805022157

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691247.74525 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619691225.9015 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691247.77625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 520 process_handle: 0x0000036c	failed	0	0
1619691247.77625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 520 process_handle: 0x0000036c	success	0	0

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.41.33
host	203.208.41.66

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691247.74525 NtAllocateVirtualMemory	process_identifier: 520 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000368 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619691247.80725 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000037c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 manipulating memory of non-child process 520
1619691247.74525 NtAllocateVirtualMemory	process_identifier: 520 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000368 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßªCÂË-Ë-Ë-VÙË-V³Ë-V°Ë-RichË-PELuçtQà @¶ @ @.textä ` process_handle: 0x0000037c base_address: 0x00400000	success	1	0
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: @ process_handle: 0x0000037c base_address: 0x7efde008	success	1	0

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßªCÂË-Ë-Ë-VÙË-V³Ë-V°Ë-RichË-PELuçtQà @¶ @ @.textä ` process_handle: 0x0000037c base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 called NtSetContextThread to modify thread in remote process 2228
1619691247.80725 NtSetContextThread	thread_handle: 0x0000036c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306496 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2228	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2996 resumed a thread in remote process 2228
1619691247.83825 NtResumeThread	thread_handle: 0x0000036c suspend_count: 1 process_identifier: 2228	success	0	0

Detects VirtualBox through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619691245.79225 LdrGetProcedureAddress	ordinal: 0 module: KERNEL32 module_address: 0x76340000 function_address: 0x0044d8f8 function_name: wine_get_unix_file_name	failed	3221225785	0

Disables Windows Security features (4 个事件)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

Executed a process and injected code into it, probably while unpacking (20 个事件)

Time & API	Arguments	Status	Return
1619691187.32325 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2996	success	0
1619691187.38525 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2996	success	0
1619691223.88525 CreateProcessInternalW	thread_identifier: 3036 thread_handle: 0x0000022c process_identifier: 1124 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000238 inherit_handles: 1	success	1
1619691245.79225 NtResumeThread	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2996	success	0
1619691246.04225 NtResumeThread	thread_handle: 0x00000330 suspend_count: 1 process_identifier: 2996	success	0
1619691247.74525 CreateProcessInternalW	thread_identifier: 2840 thread_handle: 0x00000364 process_identifier: 520 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86bb43248e3ad56e9a839cc6c7b03282.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86bb43248e3ad56e9a839cc6c7b03282.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000368 inherit_handles: 0	success	1
1619691247.74525 NtGetContextThread	thread_handle: 0x00000364	success	0
1619691247.74525 NtAllocateVirtualMemory	process_identifier: 520 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000368 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619691247.80725 CreateProcessInternalW	thread_identifier: 2240 thread_handle: 0x0000036c process_identifier: 2228 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86bb43248e3ad56e9a839cc6c7b03282.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86bb43248e3ad56e9a839cc6c7b03282.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000037c inherit_handles: 0	success	1
1619691247.80725 NtGetContextThread	thread_handle: 0x0000036c	success	0
1619691247.80725 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000037c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßªCÂË-Ë-Ë-VÙË-V³Ë-V°Ë-RichË-PELuçtQà @¶ @ @.textä ` process_handle: 0x0000037c base_address: 0x00400000	success	1
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: process_handle: 0x0000037c base_address: 0x00401000	success	1
1619691247.80725 WriteProcessMemory	process_identifier: 2228 buffer: @ process_handle: 0x0000037c base_address: 0x7efde008	success	1
1619691247.80725 NtSetContextThread	thread_handle: 0x0000036c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306496 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2228	success	0
1619691247.83825 NtResumeThread	thread_handle: 0x0000036c suspend_count: 1 process_identifier: 2228	success	0
1619691225.3545 NtResumeThread	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 1124	success	0
1619691225.3705 NtResumeThread	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 1124	success	0
1619691230.3855 NtResumeThread	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 1124	success	0
1619691230.9175 NtResumeThread	thread_handle: 0x00000454 suspend_count: 1 process_identifier: 1124	success	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSILRandomKrypt.2
FireEye	Generic.mg.86bb43248e3ad56e
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Spyware.AgentTesla
Cylance	Unsafe
K7AntiVirus	Trojan ( 005660321 )
Alibaba	TrojanSpy:Win32/AgentTesla.57631b2b
K7GW	Trojan ( 005660321 )
Cybereason	malicious.48e3ad
Arcabit	Trojan.MSILRandomKrypt.2
Cyren	W32/MSIL_Agent.BHT.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Trojan.Vendetta-8019875-0
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Gen:Heur.MSILRandomKrypt.2
NANO-Antivirus	Trojan.Win32.PackedNET.hkdjom
Paloalto	generic.ml
Tencent	Msil.Trojan-spy.Noon.Ecat
Ad-Aware	Gen:Heur.MSILRandomKrypt.2
Sophos	Mal/Generic-R + Troj/Formbo-EC
Comodo	Malware@#2b04upciag7b2
F-Secure	Trojan.TR/AD.Swotter.atbiu
DrWeb	Trojan.PackedNET.291
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R06EC0DID20
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Gen:Heur.MSILRandomKrypt.2 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanSpy.MSIL.aslg
Webroot	W32.Trojan.Gen
Avira	TR/AD.Swotter.atbiu
Antiy-AVL	Trojan[Spy]/MSIL.Noon
Gridinsoft	Trojan.Win32.Kryptik.dd!n
Microsoft	Trojan:Win32/AgentTesla.E!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Gen:Heur.MSILRandomKrypt.2
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.Kryptik.R335607
McAfee	Generic .lx
MAX	malware (ai score=81)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	Win32/Formbook.AA
TrendMicro-HouseCall	Backdoor.MSIL.REMCOS.SM
Yandex	Trojan.AvsArher.bSK66A
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.73691310.susgen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-04 05:01:42

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.1	139	192.168.56.101	49192

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.