SmartHawk

6.2

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

77d1661aa606f927f8104c2747dcbd251f49dc95d1370cab7012a6192feda210

90b794eda22702145d72381cc31fabfe.exe

分析耗时

81s

最近分析

文件大小

2.1MB

静态报毒动态报毒 100% 1DHBY9IBGEK AEQG AGENSLA AGENTTESLA AI SCORE=100 ATTRIBUTE AUTO BASIC COINMINER CONFIDENCE DW0@A8OLDVL ELDORADO GDSDA GENERICRXKW GWQLC HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK MALICIOUS PE MALWARE@#1Z5J2C5SAYZTG MINER8220 NANOCORE QVM03 SCORE SUSGEN TROJANPSW TROJANX TSCOPE UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanPSW:MSIL/Nanocore.4d7c99c5	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201028	18.4.3895.0
Tencent	Win32.Coinminer.Miner8220.Auto	20201028	1.0.0.1
Kingsoft		20201028	2013.8.14.323
McAfee	GenericRXKW-RP!90B794EDA227	20201028	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks if process is being debugged by a debugger (50 out of 81 个事件)

Time & API	Arguments	Status	Return	Repeated
1619717233.618001 IsDebuggerPresent		failed	0	0
1619717242.290001 IsDebuggerPresent		failed	0	0
1619717242.775001 IsDebuggerPresent		failed	0	0
1619717243.306001 IsDebuggerPresent		failed	0	0
1619717243.790001 IsDebuggerPresent		failed	0	0
1619717244.306001 IsDebuggerPresent		failed	0	0
1619717244.790001 IsDebuggerPresent		failed	0	0
1619717245.306001 IsDebuggerPresent		failed	0	0
1619717245.790001 IsDebuggerPresent		failed	0	0
1619717246.306001 IsDebuggerPresent		failed	0	0
1619717246.790001 IsDebuggerPresent		failed	0	0
1619717247.306001 IsDebuggerPresent		failed	0	0
1619717247.790001 IsDebuggerPresent		failed	0	0
1619717248.306001 IsDebuggerPresent		failed	0	0
1619717248.790001 IsDebuggerPresent		failed	0	0
1619717249.306001 IsDebuggerPresent		failed	0	0
1619717249.790001 IsDebuggerPresent		failed	0	0
1619717250.306001 IsDebuggerPresent		failed	0	0
1619717250.790001 IsDebuggerPresent		failed	0	0
1619717251.306001 IsDebuggerPresent		failed	0	0
1619717251.790001 IsDebuggerPresent		failed	0	0
1619717252.306001 IsDebuggerPresent		failed	0	0
1619717252.790001 IsDebuggerPresent		failed	0	0
1619717253.306001 IsDebuggerPresent		failed	0	0
1619717253.790001 IsDebuggerPresent		failed	0	0
1619717254.306001 IsDebuggerPresent		failed	0	0
1619717254.790001 IsDebuggerPresent		failed	0	0
1619717255.306001 IsDebuggerPresent		failed	0	0
1619717255.790001 IsDebuggerPresent		failed	0	0
1619717256.306001 IsDebuggerPresent		failed	0	0
1619717256.790001 IsDebuggerPresent		failed	0	0
1619717257.306001 IsDebuggerPresent		failed	0	0
1619717257.790001 IsDebuggerPresent		failed	0	0
1619717258.306001 IsDebuggerPresent		failed	0	0
1619717258.790001 IsDebuggerPresent		failed	0	0
1619717259.306001 IsDebuggerPresent		failed	0	0
1619717259.790001 IsDebuggerPresent		failed	0	0
1619717260.306001 IsDebuggerPresent		failed	0	0
1619717260.790001 IsDebuggerPresent		failed	0	0
1619717261.306001 IsDebuggerPresent		failed	0	0
1619717261.790001 IsDebuggerPresent		failed	0	0
1619717262.306001 IsDebuggerPresent		failed	0	0
1619717262.790001 IsDebuggerPresent		failed	0	0
1619717263.306001 IsDebuggerPresent		failed	0	0
1619717263.790001 IsDebuggerPresent		failed	0	0
1619717264.322001 IsDebuggerPresent		failed	0	0
1619717264.790001 IsDebuggerPresent		failed	0	0
1619717265.322001 IsDebuggerPresent		failed	0	0
1619717265.790001 IsDebuggerPresent		failed	0	0
1619717266.322001 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619717239.259001 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	\|\x14\x0cb\x04wrY
section

Allocates read-write-execute memory (usually to unpack itself) (50 out of 56 个事件)

Time & API	Arguments	Status
1619717232.525001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00bf0000	success
1619717232.525001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00d20000	success
1619717233.353001 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619717233.634001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004da000	success
1619717233.634001 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619717233.634001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d2000	success
1619717234.243001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e2000	success
1619717234.525001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e3000	success
1619717234.556001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051b000	success
1619717234.556001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00517000	success
1619717234.650001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ec000	success
1619717234.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00700000	success
1619717235.337001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e4000	success
1619717235.368001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00701000	success
1619717235.400001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ea000	success
1619717235.462001 NtProtectVirtualMemory	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 167936 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00292000	success
1619717241.181001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00702000	success
1619717241.197001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00703000	success
1619717241.212001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00704000	success
1619717241.431001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00705000	success
1619717241.650001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00706000	success
1619717241.743001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00707000	success
1619717241.806001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0050a000	success
1619717241.868001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00502000	success
1619717241.884001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e5000	success
1619717241.978001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00515000	success
1619717242.634001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e6000	success
1619717242.868001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fa000	success
1619717242.868001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f7000	success
1619717242.868001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004db000	success
1619717242.993001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e8000	success
1619717243.040001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00708000	success
1619717243.384001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b30000	success
1619717243.525001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070b000	success
1619717243.743001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00d21000	success
1619717243.743001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f6000	success
1619717243.775001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b31000	success
1619717244.025001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070c000	success
1619717277.462001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070d000	success
1619717277.509001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e9000	success
1619717277.822001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x05700000	success
1619717277.822001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b0000	success
1619717277.822001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b1000	success
1619717277.900001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b2000	success
1619717277.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b3000	success
1619717277.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b4000	success
1619717277.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b6000	success
1619717277.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057b8000	success
1619717277.915001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x057bc000	success
1619717277.993001 NtAllocateVirtualMemory	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070e000	success

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.998898100409204

section

{'size_of_data': '0x00028200', 'virtual_address': '0x00002000', 'entropy': 7.998898100409204, 'name': '|\\x14\\x0cb\\x04wrY', 'virtual_size': '0x000280a0'}

description

A section with a high entropy has been found

entropy

7.944540608459572

section

{'size_of_data': '0x001e5600', 'virtual_address': '0x0002c000', 'entropy': 7.944540608459572, 'name': '.text', 'virtual_size': '0x001e5460'}

description

A section with a high entropy has been found

entropy

0.9988120693751484

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619717235.447001 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619717279.431001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2604 process_handle: 0x00005108	failed
1619717279.431001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2604 process_handle: 0x00005108	success
1619717280.087001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1068 process_handle: 0x00006e98	failed
1619717280.087001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1068 process_handle: 0x00006e98	success
1619717280.712001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1664 process_handle: 0x0000b16c	failed
1619717280.712001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1664 process_handle: 0x0000b16c	success
1619717281.337001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2520 process_handle: 0x00004f88	failed
1619717281.337001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2520 process_handle: 0x00004f88	success
1619717282.118001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2796 process_handle: 0x0000d084	failed
1619717282.118001 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2796 process_handle: 0x0000d084	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619717278.790001 NtAllocateVirtualMemory	process_identifier: 2604 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006fd4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717279.556001 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000027c8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717280.243001 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e6a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717280.900001 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e5f0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717281.525001 NtAllocateVirtualMemory	process_identifier: 2796 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e654 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1108 manipulating memory of non-child process 2604
Process injection	Process 1108 manipulating memory of non-child process 1068
Process injection	Process 1108 manipulating memory of non-child process 1664
Process injection	Process 1108 manipulating memory of non-child process 2520
Process injection	Process 1108 manipulating memory of non-child process 2796
1619717278.790001 NtAllocateVirtualMemory	process_identifier: 2604 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006fd4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619717279.556001 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000027c8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619717280.243001 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e6a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619717280.900001 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e5f0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619717281.525001 NtAllocateVirtualMemory	process_identifier: 2796 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e654 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619717233.618001 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1108	success	0
1619717233.790001 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 1108	success	0
1619717242.181001 NtResumeThread	thread_handle: 0x000005ec suspend_count: 1 process_identifier: 1108	success	0
1619717242.228001 NtResumeThread	thread_handle: 0x000075c0 suspend_count: 1 process_identifier: 1108	success	0
1619717278.775001 CreateProcessInternalW	thread_identifier: 2964 thread_handle: 0x0000c488 process_identifier: 2604 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00006fd4 inherit_handles: 0	success	1
1619717278.790001 NtGetContextThread	thread_handle: 0x0000c488	success	0
1619717278.790001 NtAllocateVirtualMemory	process_identifier: 2604 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006fd4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717279.556001 CreateProcessInternalW	thread_identifier: 3004 thread_handle: 0x00005108 process_identifier: 1068 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000027c8 inherit_handles: 0	success	1
1619717279.556001 NtGetContextThread	thread_handle: 0x00005108	success	0
1619717279.556001 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000027c8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717280.243001 CreateProcessInternalW	thread_identifier: 176 thread_handle: 0x00006e98 process_identifier: 1664 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000e6a8 inherit_handles: 0	success	1
1619717280.243001 NtGetContextThread	thread_handle: 0x00006e98	success	0
1619717280.243001 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e6a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717280.900001 CreateProcessInternalW	thread_identifier: 1832 thread_handle: 0x0000b16c process_identifier: 2520 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000e5f0 inherit_handles: 0	success	1
1619717280.900001 NtGetContextThread	thread_handle: 0x0000b16c	success	0
1619717280.900001 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e5f0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619717281.525001 CreateProcessInternalW	thread_identifier: 2940 thread_handle: 0x00004f88 process_identifier: 2796 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b794eda22702145d72381cc31fabfe.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000e654 inherit_handles: 0	success	1
1619717281.525001 NtGetContextThread	thread_handle: 0x00004f88	success	0
1619717281.525001 NtAllocateVirtualMemory	process_identifier: 2796 region_size: 1585152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000e654 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.2.Gen
FireEye	Generic.mg.90b794eda2270214
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Spyware.AgentTesla
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 00561f911 )
Alibaba	TrojanPSW:MSIL/Nanocore.4d7c99c5
K7GW	Trojan ( 00561f911 )
Arcabit	Trojan.MSIL.Basic.2.Gen
Cyren	W32/MSIL_Troj.VP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.MSIL.Basic.2.Gen
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Coinminer.Miner8220.Auto
Ad-Aware	Trojan.MSIL.Basic.2.Gen
Sophos	Mal/Generic-S
Comodo	Malware@#1z5j2c5sayztg
F-Secure	Trojan.TR/Kryptik.gwqlc
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
MaxSecure	Trojan.Malware.74499699.susgen
Emsisoft	Trojan.MSIL.Basic.2.Gen (B)
SentinelOne	DFI - Malicious PE
Jiangmin	Trojan.PSW.MSIL.aeqg
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.gwqlc
Microsoft	Trojan:MSIL/Nanocore.PB!MTB
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.MSIL.Basic.2.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.AgentTesla.C4114780
McAfee	GenericRXKW-RP!90B794EDA227
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.UXZ
Yandex	Trojan.Kryptik!1dhBy9ibGEk
Ikarus	Trojan-Rat.NanoCore
Fortinet	MSIL/Kryptik.UXZ!tr
BitDefenderTheta	Gen:NN.ZemsilF.34590.dw0@a8OLDvl
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-04 02:06:36

Imports

Library mscoree.dll:

• 0x616000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.