SmartHawk

7.8

高危

54 个模型检测该样本为恶意！

重新分析

下载样本

7aea54e5a7af3c0486ca05606e29416b4bae058d6ca16e06afe2d57a9da90838

8c63e9a869b7c94dd7398a3217c5861f.exe

分析耗时

75s

最近分析

文件大小

525.5KB

静态报毒动态报毒 7JFF1MX5JYA AI SCORE=86 ATTRIBUTE ECKH ELDORADO FAREIT FORMBOOK GDSDA GENERICKD HESV HIGH CONFIDENCE HIGHCONFIDENCE HQZYOX INJECT3 KRYPTIK MALWARE@#1Y2LUKLJRNQK7 MALWAREX QBBH QZSNG R011C0DH720 R347004 S + TROJ SCORE SUSGEN SUSPICIOUS PE UNSAFE YAKBEEXMSIL 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVT!8C63E9A869B7	20201019	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba	Trojan:MSIL/Formbook.c722bf5b	20190527	0.3.0.5
Tencent	Msil.Trojan.Hesv.Eckh	20201019	1.0.0.1
Kingsoft		20201019	2013.8.14.323
Avast	Win32:MalwareX-gen [Trj]	20201019	18.4.3895.0
CrowdStrike		20180202	1.0

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686132.259829 IsDebuggerPresent		failed	0	0
1619686132.259829 IsDebuggerPresent		failed	0	0
1619686181.368829 IsDebuggerPresent		failed	0	0
1619686181.884829 IsDebuggerPresent		failed	0	0
1619687794.6455 IsDebuggerPresent		failed	0	0
1619687794.6455 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686132.306829 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 128 个事件)

Time & API	Arguments	Status	Return
1619686131.415829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00510000	success	0
1619686131.415829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00630000	success	0
1619686131.821829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02040000	success	0
1619686131.821829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021b0000	success	0
1619686132.009829 NtProtectVirtualMemory	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1619686132.259829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x021f0000	success	0
1619686132.259829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023d0000	success	0
1619686132.259829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fa000	success	0
1619686132.274829 NtProtectVirtualMemory	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1619686132.274829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f2000	success	0
1619686132.493829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success	0
1619686132.571829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success	0
1619686132.571829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success	0
1619686132.571829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619686132.649829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a3000	success	0
1619686132.696829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success	0
1619686132.743829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e0000	success	0
1619686133.040829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a4000	success	0
1619686133.056829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a6000	success	0
1619686133.149829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a7000	success	0
1619686133.149829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a8000	success	0
1619686133.149829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a9000	success	0
1619686133.212829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619686133.212829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619686133.306829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619686133.368829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e1000	success	0
1619686133.587829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success	0
1619686133.712829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e0000	success	0
1619686133.712829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e1000	success	0
1619686133.728829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e4000	success	0
1619686133.962829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e2000	success	0
1619686134.009829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e5000	success	0
1619686134.024829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e3000	success	0
1619686134.056829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e6000	success	0
1619686134.071829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e4000	success	0
1619686134.087829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005e9000	success	0
1619686175.087829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ad000	success	0
1619686175.087829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ea000	success	0
1619686175.103829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021b1000	success	0
1619686175.196829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005eb000	success	0
1619686175.321829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fc000	success	0
1619686175.353829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ec000	success	0
1619686175.415829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e5000	success	0
1619686175.415829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ed000	success	0
1619686175.524829 NtProtectVirtualMemory	process_identifier: 2364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 332288 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05260400	failed	3221225550
1619686180.556829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ef000	success	0
1619686180.556829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006e6000	success	0
1619686180.571829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04890000	success	0
1619686180.571829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04891000	success	0
1619686180.634829 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04892000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.847766319626512

section

{'size_of_data': '0x00082c00', 'virtual_address': '0x00002000', 'entropy': 7.847766319626512, 'name': '.text', 'virtual_size': '0x00082aa4'}

description

A section with a high entropy has been found

entropy

0.9961904761904762

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686175.509829 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619687806.5675 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686181.571829 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000ab58 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619686181.571829 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELk3+_à(~F `@ @$FW`0 H.text& ( `.rsrc0`*@@.reloc0@B process_handle: 0x0000ab58 base_address: 0x00400000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: P8h `¤Dcê¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNameBZVFEzhlqtoHstwZODVhPfeDKqhwuN.exe(LegalCopyright p#OriginalFilenameBZVFEzhlqtoHstwZODVhPfeDKqhwuN.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x0000ab58 base_address: 0x00456000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: @6 process_handle: 0x0000ab58 base_address: 0x00458000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: @ process_handle: 0x0000ab58 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686181.571829 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELk3+_à(~F `@ @$FW`0 H.text& ( `.rsrc0`*@@.reloc0@B process_handle: 0x0000ab58 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2364 called NtSetContextThread to modify thread in remote process 2960
1619686181.587829 NtSetContextThread	thread_handle: 0x00002b54 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4540030 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2960	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2364 resumed a thread in remote process 2960
1619686181.868829 NtResumeThread	thread_handle: 0x00002b54 suspend_count: 1 process_identifier: 2960	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619686132.259829 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2364	success	0
1619686132.274829 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2364	success	0
1619686132.353829 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 2364	success	0
1619686181.353829 NtResumeThread	thread_handle: 0x00009958 suspend_count: 1 process_identifier: 2364	success	0
1619686181.353829 NtResumeThread	thread_handle: 0x0000b8d8 suspend_count: 1 process_identifier: 2364	success	0
1619686181.571829 CreateProcessInternalW	thread_identifier: 2604 thread_handle: 0x00002b54 process_identifier: 2960 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8c63e9a869b7c94dd7398a3217c5861f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8c63e9a869b7c94dd7398a3217c5861f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000ab58 inherit_handles: 0	success	1
1619686181.571829 NtGetContextThread	thread_handle: 0x00002b54	success	0
1619686181.571829 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000ab58 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619686181.571829 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELk3+_à(~F `@ @$FW`0 H.text& ( `.rsrc0`*@@.reloc0@B process_handle: 0x0000ab58 base_address: 0x00400000	success	1
1619686181.571829 WriteProcessMemory	process_identifier: 2960 buffer: process_handle: 0x0000ab58 base_address: 0x00402000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: P8h `¤Dcê¤4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoà000004b0,FileDescription 0FileVersion0.0.0.0h#InternalNameBZVFEzhlqtoHstwZODVhPfeDKqhwuN.exe(LegalCopyright p#OriginalFilenameBZVFEzhlqtoHstwZODVhPfeDKqhwuN.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x0000ab58 base_address: 0x00456000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: @6 process_handle: 0x0000ab58 base_address: 0x00458000	success	1
1619686181.587829 WriteProcessMemory	process_identifier: 2960 buffer: @ process_handle: 0x0000ab58 base_address: 0x7efde008	success	1
1619686181.587829 NtSetContextThread	thread_handle: 0x00002b54 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4540030 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2960	success	0
1619686181.868829 NtResumeThread	thread_handle: 0x00002b54 suspend_count: 1 process_identifier: 2960	success	0
1619687794.6455 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2960	success	0
1619687794.7235 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2960	success	0
1619687794.7865 NtResumeThread	thread_handle: 0x000001a0 suspend_count: 1 process_identifier: 2960	success	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43604828
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FVT!8C63E9A869B7
Malwarebytes	Trojan.MalPack
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.MSIL.Hesv.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.43604828
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.c581f1
TrendMicro	TROJ_GEN.R011C0DH720
Cyren	W32/MSIL_Kryptik.BIQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Hesv.gen
Alibaba	Trojan:MSIL/Formbook.c722bf5b
NANO-Antivirus	Trojan.Win32.Hesv.hqzyox
Tencent	Msil.Trojan.Hesv.Eckh
Ad-Aware	Trojan.GenericKD.43604828
Emsisoft	Trojan.GenericKD.43604828 (B)
Comodo	Malware@#1y2lukljrnqk7
F-Secure	Trojan.TR/Kryptik.qzsng
DrWeb	Trojan.Inject3.48446
Invincea	Mal/Generic-S + Troj/MSIL-PRA
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
FireEye	Generic.mg.8c63e9a869b7c94d
Sophos	Troj/MSIL-PRA
Ikarus	Trojan.Crypt
GData	Trojan.GenericKD.43604828
Jiangmin	Trojan.MSIL.qbbh
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.qzsng
Antiy-AVL	Trojan/Win32.Generic
Arcabit	Trojan.Generic.D2995B5C
ZoneAlarm	HEUR:Trojan.MSIL.Hesv.gen
Microsoft	Trojan:MSIL/Formbook.VN!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R347004
ALYac	Trojan.GenericKD.43604828
MAX	malware (ai score=86)
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Kryptik.XGB
TrendMicro-HouseCall	TROJ_GEN.R011C0DH720
Yandex	Trojan.Kryptik!7jFF1Mx5jYA
SentinelOne	DFI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-06 08:19:37

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.