SmartHawk

9.0

极危

56 个模型检测该样本为恶意！

重新分析

下载样本

ebfc585bba8bfa8b1b8c617577a7238373fa336dd5d411dbee720dd4a906e365

96798454892e1fa751f7aa376fb999f7.exe

分析耗时

32s

最近分析

文件大小

926.0KB

静态报毒动态报毒 100% 5M0@AQP@BNH AGENSLA AGENTTESLA AI SCORE=87 ALI1000139 CLOUD CONFIDENCE DYRDN ELDORADO GDSDA GENCIRC GENERICKD GENERICRXKF HAWKEYE HIGH CONFIDENCE HIMNXU KRYPTIK MALICIOUS PE RATX SCORE SIGGEN9 STARTER SUSGEN TSCOPE ULHL4JHZBI UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKF-PF!96798454892E	20200811	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	Trojan:Win32/starter.ali1000139	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:RATX-gen [Trj]	20200811	18.4.3895.0
Tencent	Malware.Win32.Gencirc.113aa966	20200811	1.0.0.1
Kingsoft		20200811	2013.8.14.323

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781864.206249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781065.364436 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781864.784249 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\sUKTLyGbT"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781067.270436 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (34 个事件)

Time & API	Arguments	Status
1619781064.739436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004d0000	success
1619781064.739436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00550000	success
1619781065.239436 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619781065.364436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success
1619781065.364436 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619781065.364436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success
1619781065.536436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b2000	success
1619781065.629436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b3000	success
1619781065.629436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fb000	success
1619781065.629436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f7000	success
1619781065.661436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bc000	success
1619781065.707436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00780000	success
1619781066.020436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b4000	success
1619781066.020436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success
1619781066.098436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success
1619781066.223436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004da000	success
1619781066.223436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d7000	success
1619781066.223436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ea000	success
1619781066.239436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ab000	success
1619781066.348436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00781000	success
1619781066.379436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d6000	success
1619781066.598436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa0000	success
1619781066.598436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ba000	success
1619781066.739436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00551000	success
1619781066.848436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e2000	success
1619781066.879436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f5000	success
1619781067.192436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00785000	success
1619781067.192436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa1000	success
1619781067.536436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619781067.832436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00786000	success
1619781067.926436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a3000	success
1619781067.942436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa2000	success
1619781070.801436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00787000	success
1619781072.926436 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa3000	success

Creates a suspicious process (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781068.442436 ShellExecuteExW	parameters: /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.897719403341133

section

{'size_of_data': '0x000e6e00', 'virtual_address': '0x00002000', 'entropy': 7.897719403341133, 'name': '.text', 'virtual_size': '0x000e6ce4'}

description

A section with a high entropy has been found

entropy

0.9978390059427337

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781070.957436 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619781071.536436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3000 process_handle: 0x0000039c	failed
1619781071.536436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3000 process_handle: 0x0000039c	success
1619781071.895436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x000003a4	failed
1619781071.895436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2632 process_handle: 0x000003a4	success
1619781072.207436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 192 process_handle: 0x000003ac	failed
1619781072.207436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 192 process_handle: 0x000003ac	success
1619781072.598436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 520 process_handle: 0x000003b4	failed
1619781072.598436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 520 process_handle: 0x000003b4	success
1619781072.895436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1908 process_handle: 0x000003bc	failed
1619781072.895436 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1908 process_handle: 0x000003bc	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619781070.926436 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000394 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781071.614436 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781071.957436 NtAllocateVirtualMemory	process_identifier: 192 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781072.301436 NtAllocateVirtualMemory	process_identifier: 520 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781072.692436 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 368 manipulating memory of non-child process 3000
Process injection	Process 368 manipulating memory of non-child process 2632
Process injection	Process 368 manipulating memory of non-child process 192
Process injection	Process 368 manipulating memory of non-child process 520
Process injection	Process 368 manipulating memory of non-child process 1908
1619781070.926436 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000394 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781071.614436 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781071.957436 NtAllocateVirtualMemory	process_identifier: 192 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781072.301436 NtAllocateVirtualMemory	process_identifier: 520 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781072.692436 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619781065.364436 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 368	success	0
1619781065.411436 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 368	success	0
1619781067.879436 NtResumeThread	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 368	success	0
1619781068.426436 CreateProcessInternalW	thread_identifier: 2528 thread_handle: 0x0000034c process_identifier: 1632 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sUKTLyGbT" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAF.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000384 inherit_handles: 0	success	1
1619781070.911436 CreateProcessInternalW	thread_identifier: 2996 thread_handle: 0x00000340 process_identifier: 3000 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000394 inherit_handles: 0	success	1
1619781070.926436 NtGetContextThread	thread_handle: 0x00000340	success	0
1619781070.926436 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000394 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781071.614436 CreateProcessInternalW	thread_identifier: 2288 thread_handle: 0x0000039c process_identifier: 2632 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000398 inherit_handles: 0	success	1
1619781071.614436 NtGetContextThread	thread_handle: 0x0000039c	success	0
1619781071.614436 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781071.957436 CreateProcessInternalW	thread_identifier: 2240 thread_handle: 0x000003a4 process_identifier: 192 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a0 inherit_handles: 0	success	1
1619781071.957436 NtGetContextThread	thread_handle: 0x000003a4	success	0
1619781071.957436 NtAllocateVirtualMemory	process_identifier: 192 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781072.301436 CreateProcessInternalW	thread_identifier: 648 thread_handle: 0x000003ac process_identifier: 520 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a8 inherit_handles: 0	success	1
1619781072.301436 NtGetContextThread	thread_handle: 0x000003ac	success	0
1619781072.301436 NtAllocateVirtualMemory	process_identifier: 520 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781072.676436 CreateProcessInternalW	thread_identifier: 796 thread_handle: 0x000003b4 process_identifier: 1908 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\96798454892e1fa751f7aa376fb999f7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003b0 inherit_handles: 0	success	1
1619781072.692436 NtGetContextThread	thread_handle: 0x000003b4	success	0
1619781072.692436 NtAllocateVirtualMemory	process_identifier: 1908 region_size: 696320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.42947889
FireEye	Generic.mg.96798454892e1fa7
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXKF-PF!96798454892E
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.1974042
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 0056416c1 )
K7AntiVirus	Trojan ( 0056416c1 )
Invincea	heuristic
F-Prot	W32/MSIL_Injector.UA.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
GData	Trojan.GenericKD.42947889
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.42947889
NANO-Antivirus	Trojan.Win32.Agensla.himnxu
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Agensla.i!c
Tencent	Malware.Win32.Gencirc.113aa966
Ad-Aware	Trojan.GenericKD.42947889
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Kryptik.dyrdn
DrWeb	Trojan.Siggen9.34502
VIPRE	Trojan.Win32.Generic!BT
Emsisoft	Trojan.GenericKD.42947889 (B)
SentinelOne	DFI - Malicious PE
Cyren	W32/MSIL_Injector.UA.gen!Eldorado
Jiangmin	Trojan.PSW.MSIL.vby
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.dyrdn
Antiy-AVL	Trojan[PSW]/MSIL.Agensla
Arcabit	Trojan.Generic.D28F5531
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Trojan:MSIL/AgentTesla!MTB
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.RL_Generic.C4054588
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.Agent.HawkEye
MAX	malware (ai score=87)
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.WBI
Rising	Trojan.Kryptik!8.8 (CLOUD)
Yandex	Trojan.Kryptik!/ulHL4JhZbI
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-07 05:26:00

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.