SmartHawk

7.0

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

bf47d5acf4f22317a6f111029025df2d5397653a4708d8a5ce36f2ab6e5e6e5b

879d8e57631ddf49fb7c651379f01547.exe

分析耗时

72s

最近分析

文件大小

2.3MB

静态报毒动态报毒 100% AI SCORE=99 AIOE ARTEMIS BLACK BSCOPE CLOUD COINMINER CONFIDENCE DOWNLOADER33 GDSDA GEN2 GENERICKD HBDMPW HIGH HIGH CONFIDENCE HW32 MALICIOUS PE MALWARE@#3L9LQTOTV203Y MINER OCCAMY QVM16 R002C0RBK20 SCORE SUSGEN UNSAFE UOYX VMPROTBAD VMPROTECT WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!879D8E57631D	20200326	6.0.6.653
Alibaba	Trojan:Win32/Miner.7392b11d	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20200327	18.4.3895.0
Baidu	Win32.Packed.VMProtect.a	20190318	1.0.0.2
Kingsoft		20200327	2013.8.14.323
Tencent		20200327	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Command line console output was observed (50 out of 7562 个事件)

Time & API	Arguments	Status	Return
1620833368.304124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833368.304124 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1620833368.304124 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833368.585124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe console_handle: 0x00000007	success	1
1620833370.226124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1620833370.242124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.242124 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1620833370.242124 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.242124 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1620833370.242124 WriteConsoleW	buffer: try console_handle: 0x00000007	success	1
1620833370.257124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.257124 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1620833370.257124 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1620833370.304124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: try console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1620833370.304124 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1620833370.320124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1620833370.320124 WriteConsoleW	buffer: try console_handle: 0x00000007	success	1
1620833370.335124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.335124 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1620833370.335124 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1620833370.351124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: try console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1620833370.351124 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1620833370.367124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe" console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1620833370.367124 WriteConsoleW	buffer: try console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620833362.507001 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (5 个事件)

section	CODE
section	DATA
section	BSS
section	.IOS0
section	.IOS1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 128 个事件)

Time & API	Arguments	Status	Return
1620833361.148249 NtProtectVirtualMemory	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success	0
1620833361.492249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ec0000	success	0
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77930000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77940000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77950000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77960000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77970000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77980000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77990000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779a0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779b0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779c0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779d0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779e0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x779f0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a00000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a10000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a20000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a30000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a40000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a50000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a60000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a70000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a80000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77a90000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77aa0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ab0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ac0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ad0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ae0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77af0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b00000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b10000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b20000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b30000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b40000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b50000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b60000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b70000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b80000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77b90000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77ba0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77bb0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77bc0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77bd0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77be0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77bf0000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77c00000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77c10000	failed	3221225496
1620833361.507249 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x77c20000	failed	3221225496

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_delxmr.bat

Creates a service (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620833369.851001 CreateServiceA	service_start_name: start_type: 2 service_handle: 0x002ff638 display_name: Windows Network WiredConfig Service error_control: 0 service_name: WiredService filepath: C:\ProgramData\Microsoft\RAC\lsass.exe filepath_r: C:\ProgramData\Microsoft\RAC\lsass.exe service_manager_handle: 0x002ffa20 desired_access: 983551 service_type: 272 password:	success	3143224	0

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\879d8e57631ddf49fb7c651379f01547.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.997989122469038

section

{'size_of_data': '0x00258600', 'virtual_address': '0x0026e000', 'entropy': 7.997989122469038, 'name': '.IOS1', 'virtual_size': '0x0025855f'}

description

A section with a high entropy has been found

entropy

0.9997918401332223

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Installs itself for autorun at Windows startup (1 个事件)

service_name

WiredService

service_path

C:\ProgramData\Microsoft\RAC\lsass.exe

Created a process named as a common system process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620833361.976249 CreateProcessInternalW	thread_identifier: 1816 thread_handle: 0x0000014c process_identifier: 2632 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\ProgramData\Microsoft\RAC\lsass.exe track: 1 command_line: "C:\ProgramData\Microsoft\RAC\lsass.exe" filepath_r: C:\ProgramData\Microsoft\RAC\lsass.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000001f0 inherit_handles: 0	success	1	0
1620833361.976249 ShellExecuteExW	parameters: filepath: C:\ProgramData\Microsoft\RAC\lsass.exe filepath_r: C:\ProgramData\Microsoft\RAC\lsass.exe show_type: 1	success	1	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	HW32.Packed.
DrWeb	Trojan.DownLoader33.3826
MicroWorld-eScan	Trojan.GenericKD.33566440
FireEye	Generic.mg.879d8e57631ddf49
CAT-QuickHeal	Trojan.Win64
McAfee	Artemis!879D8E57631D
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 004046cf1 )
Alibaba	Trojan:Win32/Miner.7392b11d
K7GW	Trojan ( 004046cf1 )
Cybereason	malicious.7631dd
Arcabit	Trojan.Generic.D2002EE8
Invincea	heuristic
BitDefenderTheta	AI:Packer.B691B37B1E
ESET-NOD32	a variant of Win32/CoinMiner.BSW
TrendMicro-HouseCall	TROJ_GEN.R002C0RBK20
Avast	Win32:Trojan-gen
Kaspersky	Trojan.Win64.Miner.aioe
BitDefender	Trojan.GenericKD.33566440
NANO-Antivirus	Trojan.Win32.Black.hbdmpw
Paloalto	generic.ml
AegisLab	Trojan.Win32.Malicious.4!c
Rising	Trojan.CoinMiner!8.30A (CLOUD)
Ad-Aware	Trojan.GenericKD.33566440
Emsisoft	Trojan.GenericKD.33566440 (B)
Comodo	Malware@#3l9lqtotv203y
F-Secure	Trojan.TR/Black.Gen2
Baidu	Win32.Packed.VMProtect.a
Zillya	Trojan.CoinMiner.Win32.25568
TrendMicro	TROJ_GEN.R002C0RBK20
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.vc
Trapmine	malicious.high.ml.score
Sophos	Mal/VMProtBad-A
Ikarus	Worm.Win32.AutoRun
Cyren	W32/Trojan.UOYX-7596
Avira	TR/Black.Gen2
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Occamy.C
Endgame	malicious (high confidence)
ViRobot	Trojan.Win32.Z.Vmprotect.2460672
ZoneAlarm	Trojan.Win64.Miner.aioe
GData	Trojan.GenericKD.33566440
Acronis	suspicious
VBA32	BScope.Trojan.Miner
ALYac	Trojan.GenericKD.33566440
APEX	Malicious
Yandex	Trojan.VMProtect!

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x6ed000 DeleteCriticalSection

• 0x6ed004 LeaveCriticalSection

• 0x6ed008 EnterCriticalSection

• 0x6ed00c InitializeCriticalSection

• 0x6ed010 VirtualFree

• 0x6ed014 VirtualAlloc

• 0x6ed018 LocalFree

• 0x6ed01c LocalAlloc

• 0x6ed020 GetVersion

• 0x6ed024 GetCurrentThreadId

• 0x6ed028 WideCharToMultiByte

• 0x6ed02c lstrlenA

• 0x6ed030 lstrcpynA

• 0x6ed034 LoadLibraryExA

• 0x6ed038 GetThreadLocale

• 0x6ed03c GetStartupInfoA

• 0x6ed040 GetProcAddress

• 0x6ed044 GetModuleHandleA

• 0x6ed048 GetModuleFileNameA

• 0x6ed04c GetLocaleInfoA

• 0x6ed050 GetLastError

• 0x6ed054 GetCommandLineA

• 0x6ed058 FreeLibrary

• 0x6ed05c FindFirstFileA

• 0x6ed060 FindClose

• 0x6ed064 ExitProcess

• 0x6ed068 WriteFile

• 0x6ed06c UnhandledExceptionFilter

• 0x6ed070 SetFilePointer

• 0x6ed074 SetEndOfFile

• 0x6ed078 RtlUnwind

• 0x6ed07c ReadFile

• 0x6ed080 RaiseException

• 0x6ed084 GetStdHandle

• 0x6ed088 GetFileSize

• 0x6ed08c GetFileType

• 0x6ed090 CreateFileA

• 0x6ed094 CloseHandle

Library user32.dll:

• 0x6ed09c GetKeyboardType

• 0x6ed0a0 LoadStringA

• 0x6ed0a4 MessageBoxA

• 0x6ed0a8 CharNextA

Library advapi32.dll:

• 0x6ed0b0 RegQueryValueExA

• 0x6ed0b4 RegOpenKeyExA

• 0x6ed0b8 RegCloseKey

Library oleaut32.dll:

• 0x6ed0c0 SysFreeString

Library kernel32.dll:

• 0x6ed0c8 TlsSetValue

• 0x6ed0cc TlsGetValue

• 0x6ed0d0 LocalAlloc

• 0x6ed0d4 GetModuleHandleA

Library advapi32.dll:

• 0x6ed0dc SetSecurityDescriptorDacl

• 0x6ed0e0 SetKernelObjectSecurity

• 0x6ed0e4 OpenProcessToken

• 0x6ed0e8 MakeAbsoluteSD

• 0x6ed0ec LookupPrivilegeValueA

• 0x6ed0f0 ImpersonateLoggedOnUser

• 0x6ed0f4 GetSecurityDescriptorDacl

• 0x6ed0f8 GetKernelObjectSecurity

• 0x6ed0fc DuplicateTokenEx

• 0x6ed100 CreateProcessAsUserA

• 0x6ed104 AdjustTokenPrivileges

Library kernel32.dll:

• 0x6ed10c WriteFile

• 0x6ed110 VirtualQuery

• 0x6ed114 OpenProcess

• 0x6ed118 LoadLibraryA

• 0x6ed11c HeapFree

• 0x6ed120 HeapAlloc

• 0x6ed124 GetVersionExA

• 0x6ed128 GetThreadLocale

• 0x6ed12c GetStringTypeExA

• 0x6ed130 GetStdHandle

• 0x6ed134 GetProcessHeap

• 0x6ed138 GetProcAddress

• 0x6ed13c GetModuleHandleA

• 0x6ed140 GetModuleFileNameA

• 0x6ed144 GetLocaleInfoA

• 0x6ed148 GetLastError

• 0x6ed14c GetDiskFreeSpaceA

• 0x6ed150 GetCurrentProcess

• 0x6ed154 GetCPInfo

• 0x6ed158 GetACP

• 0x6ed15c FindFirstFileA

• 0x6ed160 FindClose

• 0x6ed164 FileTimeToLocalFileTime

• 0x6ed168 FileTimeToDosDateTime

• 0x6ed16c EnumCalendarInfoA

• 0x6ed170 CreateProcessA

• 0x6ed174 CreateFileA

• 0x6ed178 CopyFileA

• 0x6ed17c CloseHandle

Library user32.dll:

• 0x6ed184 MessageBoxA

• 0x6ed188 LoadStringA

• 0x6ed18c GetSystemMetrics

• 0x6ed190 CharNextA

• 0x6ed194 CharToOemA

Library kernel32.dll:

• 0x6ed19c Sleep

Library advapi32.dll:

• 0x6ed1a4 StartServiceA

• 0x6ed1a8 StartServiceCtrlDispatcherA

• 0x6ed1ac SetServiceStatus

• 0x6ed1b0 RegisterServiceCtrlHandlerA

• 0x6ed1b4 OpenServiceA

• 0x6ed1b8 OpenSCManagerA

• 0x6ed1bc DeleteService

• 0x6ed1c0 CreateServiceA

• 0x6ed1c4 ControlService

• 0x6ed1c8 CloseServiceHandle

Library shell32.dll:

• 0x6ed1d0 ShellExecuteA

Library advapi32.dll:

• 0x6ed1d8 SetEntriesInAclA

• 0x6ed1dc BuildExplicitAccessWithNameA

Library kernel32.dll:

• 0x6ed1e4 LoadLibraryA

• 0x6ed1e8 GetProcAddress

• 0x6ed1ec GetLastError

• 0x6ed1f0 FreeLibrary

• 0x6ed1f4 InitializeCriticalSection

• 0x6ed1f8 GetModuleFileNameW

• 0x6ed1fc GetModuleHandleW

• 0x6ed200 TerminateProcess

• 0x6ed204 GetCurrentProcess

• 0x6ed208 DeleteCriticalSection

• 0x6ed20c LoadLibraryW

• 0x6ed210 CreateEventW

• 0x6ed214 CompareStringW

• 0x6ed218 SetLastError

• 0x6ed21c GetModuleHandleA

• 0x6ed220 VirtualProtect

• 0x6ed224 GetTickCount

• 0x6ed228 EnterCriticalSection

• 0x6ed22c LeaveCriticalSection

• 0x6ed230 VirtualFree

• 0x6ed234 VirtualAlloc

• 0x6ed238 WriteProcessMemory

• 0x6ed23c CreateToolhelp32Snapshot

• 0x6ed240 GetCurrentProcessId

• 0x6ed244 GetCurrentThreadId

• 0x6ed248 Thread32First

• 0x6ed24c OpenThread

• 0x6ed250 Thread32Next

• 0x6ed254 CloseHandle

• 0x6ed258 SuspendThread

• 0x6ed25c ResumeThread

• 0x6ed260 GetSystemInfo

• 0x6ed264 LoadResource

• 0x6ed268 MultiByteToWideChar

• 0x6ed26c WideCharToMultiByte

• 0x6ed270 FindResourceExW

• 0x6ed274 FindResourceExA

• 0x6ed278 GetThreadLocale

• 0x6ed27c GetUserDefaultLCID

• 0x6ed280 GetSystemDefaultLCID

• 0x6ed284 EnumResourceNamesA

• 0x6ed288 EnumResourceNamesW

• 0x6ed28c EnumResourceLanguagesA

• 0x6ed290 EnumResourceLanguagesW

• 0x6ed294 EnumResourceTypesA

• 0x6ed298 EnumResourceTypesW

• 0x6ed29c HeapAlloc

• 0x6ed2a0 HeapFree

• 0x6ed2a4 HeapDestroy

• 0x6ed2a8 HeapCreate

• 0x6ed2ac GetSystemTime

• 0x6ed2b0 GetLocalTime

• 0x6ed2b4 SystemTimeToFileTime

• 0x6ed2b8 CompareFileTime

• 0x6ed2bc GetCommandLineA

• 0x6ed2c0 GetCPInfo

• 0x6ed2c4 InterlockedIncrement

• 0x6ed2c8 InterlockedDecrement

• 0x6ed2cc GetACP

• 0x6ed2d0 GetOEMCP

• 0x6ed2d4 IsValidCodePage

• 0x6ed2d8 TlsGetValue

• 0x6ed2dc TlsAlloc

• 0x6ed2e0 TlsSetValue

• 0x6ed2e4 TlsFree

• 0x6ed2e8 LCMapStringA

• 0x6ed2ec LCMapStringW

• 0x6ed2f0 UnhandledExceptionFilter

• 0x6ed2f4 SetUnhandledExceptionFilter

• 0x6ed2f8 IsDebuggerPresent

• 0x6ed2fc WriteFile

• 0x6ed300 GetStdHandle

• 0x6ed304 GetModuleFileNameA

• 0x6ed308 RaiseException

• 0x6ed30c Sleep

• 0x6ed310 ExitProcess

• 0x6ed314 SetHandleCount

• 0x6ed318 GetFileType

• 0x6ed31c GetStartupInfoA

• 0x6ed320 FreeEnvironmentStringsA

• 0x6ed324 GetEnvironmentStrings

• 0x6ed328 FreeEnvironmentStringsW

• 0x6ed32c GetEnvironmentStringsW

• 0x6ed330 QueryPerformanceCounter

• 0x6ed334 GetSystemTimeAsFileTime

• 0x6ed338 HeapReAlloc

• 0x6ed33c GetStringTypeA

• 0x6ed340 GetStringTypeW

• 0x6ed344 GetLocaleInfoA

• 0x6ed348 RtlUnwind

• 0x6ed34c HeapSize

• 0x6ed350 SetFilePointer

• 0x6ed354 GetConsoleCP

• 0x6ed358 GetConsoleMode

• 0x6ed35c InitializeCriticalSectionAndSpinCount

• 0x6ed360 SetStdHandle

• 0x6ed364 WriteConsoleA

• 0x6ed368 GetConsoleOutputCP

• 0x6ed36c WriteConsoleW

• 0x6ed370 CreateFileA

• 0x6ed374 FlushFileBuffers

• 0x6ed378 VirtualQuery

Library user32.dll:

• 0x6ed380 MessageBoxW

• 0x6ed384 CharUpperBuffW

Library kernel32.dll:

• 0x6ed38c GetModuleFileNameW

Library kernel32.dll:

• 0x6ed394 GetModuleHandleA

• 0x6ed398 LoadLibraryA

• 0x6ed39c LocalAlloc

• 0x6ed3a0 LocalFree

• 0x6ed3a4 GetModuleFileNameA

• 0x6ed3a8 ExitProcess

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	142.250.66.110
pool.minexmr.com	A 88.99.193.240 A 136.243.49.177 A 94.130.164.163 A 51.68.21.186 A 51.68.21.188 A 94.130.165.87 A 94.130.165.85 A 51.254.84.37 A 178.32.120.127	136.243.49.177
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49182	94.130.165.85 pool.minexmr.com	7777

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.