SmartHawk

14.6

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

aec83b31afe9607016c7698162d85240a7a17d5399b99bb92572fa36f173e738

8ba767f894b7c87c19f70276a618c875.exe

分析耗时

79s

最近分析

文件大小

777.0KB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=82 BEHAVIOR CLOUD CONFIDENCE EDNZ ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HONRZA IGENERIC KRYPTIK MALICIOUS PE MALWARE@#1R6R56E0XJ4GW MALWAREX MSILKRYPT NANOCORE NOANCOOE OCNDK PACKEDNET R345070 SCORE THGAFBO TSCOPE UNSAFE WM0@AWOHGYE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXH!8BA767F894B7	20200821	6.0.6.653
Alibaba	Trojan:MSIL/AgentTesla.7849dd86	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200821	18.4.3895.0
Tencent	Msil.Trojan.Crypt.Ednz	20200821	1.0.0.1
Kingsoft		20200821	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619703033.71675 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619703036.467 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686135.774465 IsDebuggerPresent		failed	0	0
1619686135.774465 IsDebuggerPresent		failed	0	0
1619703030.7335 IsDebuggerPresent		failed	0	0
1619703030.7335 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619703034.31075 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service"。 console_handle: 0x00000007	success	1	0
1619703037.17 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service Task"。 console_handle: 0x00000007	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686135.805465 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 173 个事件)

Time & API	Arguments	Status
1619686134.821465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ca0000	success
1619686134.821465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e50000	success
1619686135.242465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00370000	success
1619686135.242465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a0000	success
1619686135.383465 NtProtectVirtualMemory	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619686135.774465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00950000	success
1619686135.774465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b0000	success
1619686135.774465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success
1619686135.774465 NtProtectVirtualMemory	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619686135.774465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1619686136.149465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1619686136.430465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00415000	success
1619686136.430465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041b000	success
1619686136.430465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success
1619686136.680465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success
1619686136.805465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fc000	success
1619686136.899465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success
1619686136.930465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f4000	success
1619686136.930465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a91000	success
1619686136.930465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a92000	success
1619686136.930465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a93000	success
1619686136.977465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a94000	success
1619686136.977465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a95000	success
1619686137.414465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f5000	success
1619686137.446465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success
1619686137.696465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f8000	success
1619686137.742465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a96000	success
1619686137.821465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f9000	success
1619686137.821465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a00000	success
1619686137.836465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a97000	success
1619686138.008465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a98000	success
1619686138.071465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a01000	success
1619686138.102465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success
1619686138.149465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a02000	success
1619686138.149465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1619686138.149465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success
1619686138.227465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a99000	success
1619686138.242465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a03000	success
1619686138.242465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fd000	success
1619686138.274465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a9a000	success
1619686138.305465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a9c000	success
1619686176.305465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a9d000	success
1619686176.727465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success
1619686176.727465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a9e000	success
1619686176.742465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a04000	success
1619686176.805465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a9f000	success
1619686176.805465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a05000	success
1619686176.805465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b1000	success
1619686176.805465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b2000	success
1619686176.821465 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x009b3000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (2 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpC6B.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp17D.tmp"

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619703033.4525 CreateProcessInternalW	thread_identifier: 1344 thread_handle: 0x00000258 process_identifier: 2576 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp17D.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000260 inherit_handles: 1	success	1	0
1619703036.0775 CreateProcessInternalW	thread_identifier: 920 thread_handle: 0x00000258 process_identifier: 1824 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpC6B.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000294 inherit_handles: 1	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.382639486758197

section

{'size_of_data': '0x000c1a00', 'virtual_address': '0x00002000', 'entropy': 7.382639486758197, 'name': '.text', 'virtual_size': '0x000c19c4'}

description

A section with a high entropy has been found

entropy

0.9974243399871217

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619703039.0305 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpC6B.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp17D.tmp"

One or more of the buffers contains an embedded PE file (7 个事件)

buffer	Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer	Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer	Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer	Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
buffer	Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	79.134.225.85

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686177.039465 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 491520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000214 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619703039.4985 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

8ba767f894b7c87c19f70276a618c875.exe tried to sleep 2728240 seconds, actually delayed analysis time by 2728240 seconds

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service

reg_value

C:\Program Files (x86)\DSL Service\dslsvc.exe

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619686177.039465 WriteProcessMemory	process_identifier: 2668 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈRç @ 8çW N H.textÇ È `.relocÊ@B.rsrcN PÌ@@ process_handle: 0x00000214 base_address: 0x00400000	success	1
1619686177.055465 WriteProcessMemory	process_identifier: 2668 buffer: à7 process_handle: 0x00000214 base_address: 0x00420000	success	1
1619686177.055465 WriteProcessMemory	process_identifier: 2668 buffer: @ process_handle: 0x00000214 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686177.039465 WriteProcessMemory	process_identifier: 2668 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈRç @ 8çW N H.textÇ È `.relocÊ@B.rsrcN PÌ@@ process_handle: 0x00000214 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 732 called NtSetContextThread to modify thread in remote process 2668
1619686177.055465 NtSetContextThread	thread_handle: 0x00000210 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2668	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8ba767f894b7c87c19f70276a618c875.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 732 resumed a thread in remote process 2668
1619686177.336465 NtResumeThread	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2668	success	0	0

Executed a process and injected code into it, probably while unpacking (27 个事件)

Time & API	Arguments	Status	Return
1619686135.774465 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 732	success	0
1619686135.774465 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 732	success	0
1619686135.899465 NtResumeThread	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 732	success	0
1619686177.039465 CreateProcessInternalW	thread_identifier: 1816 thread_handle: 0x00000210 process_identifier: 2668 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8ba767f894b7c87c19f70276a618c875.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8ba767f894b7c87c19f70276a618c875.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000214 inherit_handles: 0	success	1
1619686177.039465 NtGetContextThread	thread_handle: 0x00000210	success	0
1619686177.039465 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 491520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000214 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619686177.039465 WriteProcessMemory	process_identifier: 2668 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈRç @ 8çW N H.textÇ È `.relocÊ@B.rsrcN PÌ@@ process_handle: 0x00000214 base_address: 0x00400000	success	1
1619686177.039465 WriteProcessMemory	process_identifier: 2668 buffer: process_handle: 0x00000214 base_address: 0x00402000	success	1
1619686177.055465 WriteProcessMemory	process_identifier: 2668 buffer: à7 process_handle: 0x00000214 base_address: 0x00420000	success	1
1619686177.055465 WriteProcessMemory	process_identifier: 2668 buffer: process_handle: 0x00000214 base_address: 0x00422000	success	1
1619686177.055465 WriteProcessMemory	process_identifier: 2668 buffer: @ process_handle: 0x00000214 base_address: 0x7efde008	success	1
1619686177.055465 NtSetContextThread	thread_handle: 0x00000210 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2668	success	0
1619686177.336465 NtResumeThread	thread_handle: 0x00000210 suspend_count: 1 process_identifier: 2668	success	0
1619703030.7335 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2668	success	0
1619703030.7485 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2668	success	0
1619703030.8275 NtResumeThread	thread_handle: 0x00000138 suspend_count: 1 process_identifier: 2668	success	0
1619703033.4525 CreateProcessInternalW	thread_identifier: 1344 thread_handle: 0x00000258 process_identifier: 2576 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp17D.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000260 inherit_handles: 1	success	1
1619703036.0775 CreateProcessInternalW	thread_identifier: 920 thread_handle: 0x00000258 process_identifier: 1824 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpC6B.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000294 inherit_handles: 1	success	1
1619703038.8585 NtResumeThread	thread_handle: 0x000002bc suspend_count: 1 process_identifier: 2668	success	0
1619703038.8735 NtResumeThread	thread_handle: 0x000002d0 suspend_count: 1 process_identifier: 2668	success	0
1619703038.9835 NtResumeThread	thread_handle: 0x000002f0 suspend_count: 1 process_identifier: 2668	success	0
1619703039.3425 NtResumeThread	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2668	success	0
1619703040.2485 NtResumeThread	thread_handle: 0x0000035c suspend_count: 1 process_identifier: 2668	success	0
1619703041.4675 NtResumeThread	thread_handle: 0x00000370 suspend_count: 1 process_identifier: 2668	success	0
1619703041.9835 NtResumeThread	thread_handle: 0x00000388 suspend_count: 1 process_identifier: 2668	success	0
1619703042.3275 NtResumeThread	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 2668	success	0
1619703047.2645 NtResumeThread	thread_handle: 0x000003c4 suspend_count: 1 process_identifier: 2668	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34181153
FireEye	Generic.mg.8ba767f894b7c87c
CAT-QuickHeal	Trojan.IGENERIC
McAfee	Fareit-FXH!8BA767F894B7
Malwarebytes	Spyware.AgentTesla
Zillya	Trojan.Kryptik.Win32.2257999
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ab8e1 )
Alibaba	Trojan:MSIL/AgentTesla.7849dd86
K7GW	Trojan ( 0056ab8e1 )
Cybereason	malicious.182706
TrendMicro	Backdoor.MSIL.NOANCOOE.THGAFBO
BitDefenderTheta	Gen:NN.ZemsilF.34186.Wm0@aWohGye
Cyren	W32/MSIL_Kryptik.BDC.gen!Eldorado
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Nanocore-9104349-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34181153
NANO-Antivirus	Trojan.Win32.Crypt.honrza
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Msil.Trojan.Crypt.Ednz
Ad-Aware	Trojan.GenericKD.34181153
Comodo	Malware@#1r6r56e0xj4gw
F-Secure	Trojan.TR/AD.Nanocore.ocndk
DrWeb	Trojan.PackedNET.393
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Keylogger.AgentTesla
Avira	TR/AD.Nanocore.ocndk
MAX	malware (ai score=82)
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:MSIL/AgentTesla.MK!MTB
ViRobot	Trojan.Win32.Z.Agent.795648.AC
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.34181153
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.MSILKrypt.R345070
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.GenericKD.34181153
Cylance	Unsafe
ESET-NOD32	a variant of MSIL/Kryptik.WWX
TrendMicro-HouseCall	Backdoor.MSIL.NOANCOOE.THGAFBO
Rising	Backdoor.Noancooe!8.176 (CLOUD)
SentinelOne	DFI - Malicious PE
eGambit	Unsafe.AI_Score_78%

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	192.168.56.101:49186
dead_host	192.168.56.101:49185
dead_host	79.134.225.85:2468

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-16 12:44:30

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	63430	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.