SmartHawk

14.4

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

2ffe2f79431ad1825f286613e2e80238e30f87bdcf1007911f069b34b57ccd08

987972fa824faf9e8dbd5ea3e49c3acf.exe

分析耗时

76s

最近分析

文件大小

591.0KB

静态报毒动态报毒 100% AGENTTESLA ATTRIBUTE AUTO BIWGY BTEOJU CONFIDENCE DOWNLOADER33 EJNX ELDORADO FAREIT GENERICKD GENKRYPTIK HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HJRGEW IGENT KM0@AUTFS0B KRYPTIK MALWARE@#N5L701DLCU54 NANOBOT NANOCO NANOCORE PWSX R + TROJ R066C0DHK20 R335088 SCORE STATIC AI SUSGEN SUSPICIOUS PE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FSX!987972FA824F	20201225	6.0.6.653
Alibaba	Backdoor:Win32/AgentTesla.9f0c0a4a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201225	21.1.5827.0
Kingsoft		20201225	2017.9.26.565
Tencent	Win32.Trojan.Inject.Auto	20201225	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619788726.55975 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619788722.872499 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781066.561212 IsDebuggerPresent		failed	0	0
1619788721.04375 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619788723.668499 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service"。 console_handle: 0x00000007	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619788726.15375 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 个事件)

domain

dealbaba.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 130 个事件)

Time & API	Arguments	Status
1619781065.624212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00420000	success
1619781065.624212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00520000	success
1619781066.389212 NtProtectVirtualMemory	process_identifier: 364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619781066.561212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success
1619781066.561212 NtProtectVirtualMemory	process_identifier: 364 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619781066.561212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success
1619781067.061212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b2000	success
1619781067.264212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b3000	success
1619781067.296212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004eb000	success
1619781067.296212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e7000	success
1619781067.343212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bc000	success
1619781067.468212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a0000	success
1619781067.983212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b4000	success
1619781067.983212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success
1619781068.014212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success
1619781068.014212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619781068.093212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ca000	success
1619781068.093212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success
1619781068.093212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004da000	success
1619781068.108212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ab000	success
1619781068.155212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a1000	success
1619781068.327212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c6000	success
1619781068.405212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ba000	success
1619781068.452212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a50000	success
1619781068.483212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00521000	success
1619781068.593212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d2000	success
1619781068.624212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e5000	success
1619781068.764212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a6000	success
1619781068.874212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a7000	success
1619781068.889212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b8000	success
1619781069.124212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a3000	success
1619781069.171212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x04a30000	success
1619781069.171212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a30000	success
1619781069.171212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a31000	success
1619781069.202212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a32000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a33000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a34000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a35000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a36000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a39000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a3d000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a4e000	success
1619781069.218212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a51000	success
1619781069.233212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b9000	success
1619781069.249212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a8000	success
1619781069.264212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a9000	success
1619781069.343212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008aa000	success
1619781069.436212 NtAllocateVirtualMemory	process_identifier: 364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a51000	success
1619788720.91875 NtAllocateVirtualMemory	process_identifier: 3040 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006d0000	success
1619788720.91875 NtAllocateVirtualMemory	process_identifier: 3040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00790000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (1 个事件)

cmdline

"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6982.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619788722.54375 CreateProcessInternalW	thread_identifier: 3056 thread_handle: 0x000001f4 process_identifier: 2984 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6982.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x000001f8 inherit_handles: 1	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.291242044613112

section

{'size_of_data': '0x00093200', 'virtual_address': '0x00002000', 'entropy': 7.291242044613112, 'name': '.text', 'virtual_size': '0x00093054'}

description

A section with a high entropy has been found

entropy

0.9966130397967824

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781069.468212 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619788726.04375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (4 个事件)

Time & API	Arguments	Status
1619781069.749212 NtTerminateProcess	status_code: 0xffffffff process_identifier: 912 process_handle: 0x00000284	failed
1619781069.749212 NtTerminateProcess	status_code: 0xffffffff process_identifier: 912 process_handle: 0x00000284	success
1619781070.155212 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2228 process_handle: 0x00000290	failed
1619781070.155212 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2228 process_handle: 0x00000290	success

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6982.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (3 个事件)

Time & API	Arguments	Status	Return
1619781069.436212 NtAllocateVirtualMemory	process_identifier: 912 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000228 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781069.811212 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781070.296212 NtAllocateVirtualMemory	process_identifier: 3040 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000028c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619788726.52875 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

987972fa824faf9e8dbd5ea3e49c3acf.exe tried to sleep 2728348 seconds, actually delayed analysis time by 2728348 seconds

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6982.tmp

Manipulates memory of a non-child process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 364 manipulating memory of non-child process 912
Process injection	Process 364 manipulating memory of non-child process 2228
1619781069.436212 NtAllocateVirtualMemory	process_identifier: 912 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000228 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781069.811212 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619781070.296212 WriteProcessMemory	process_identifier: 3040 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW ¸_ H.textÇ È `.relocÊ@B.rsrc¸_ `Ì@@ process_handle: 0x0000028c base_address: 0x00400000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: à7 process_handle: 0x0000028c base_address: 0x00420000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: @ process_handle: 0x0000028c base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781070.296212 WriteProcessMemory	process_identifier: 3040 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW ¸_ H.textÇ È `.relocÊ@B.rsrc¸_ `Ì@@ process_handle: 0x0000028c base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 364 called NtSetContextThread to modify thread in remote process 3040
1619781070.311212 NtSetContextThread	thread_handle: 0x00000290 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3040	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 364 resumed a thread in remote process 3040
1619781070.577212 NtResumeThread	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 3040	success	0	0

Executed a process and injected code into it, probably while unpacking (25 个事件)

Time & API	Arguments	Status	Return
1619781066.561212 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 364	success	0
1619781066.655212 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 364	success	0
1619781069.436212 CreateProcessInternalW	thread_identifier: 472 thread_handle: 0x00000224 process_identifier: 912 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000228 inherit_handles: 0	success	1
1619781069.436212 NtGetContextThread	thread_handle: 0x00000224	success	0
1619781069.436212 NtAllocateVirtualMemory	process_identifier: 912 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000228 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781069.811212 CreateProcessInternalW	thread_identifier: 2636 thread_handle: 0x00000284 process_identifier: 2228 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000288 inherit_handles: 0	success	1
1619781069.811212 NtGetContextThread	thread_handle: 0x00000284	success	0
1619781069.811212 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781070.296212 CreateProcessInternalW	thread_identifier: 1476 thread_handle: 0x00000290 process_identifier: 3040 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\987972fa824faf9e8dbd5ea3e49c3acf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000028c inherit_handles: 0	success	1
1619781070.296212 NtGetContextThread	thread_handle: 0x00000290	success	0
1619781070.296212 NtAllocateVirtualMemory	process_identifier: 3040 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000028c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619781070.296212 WriteProcessMemory	process_identifier: 3040 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW ¸_ H.textÇ È `.relocÊ@B.rsrc¸_ `Ì@@ process_handle: 0x0000028c base_address: 0x00400000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: process_handle: 0x0000028c base_address: 0x00402000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: à7 process_handle: 0x0000028c base_address: 0x00420000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: process_handle: 0x0000028c base_address: 0x00422000	success	1
1619781070.311212 WriteProcessMemory	process_identifier: 3040 buffer: @ process_handle: 0x0000028c base_address: 0x7efde008	success	1
1619781070.311212 NtSetContextThread	thread_handle: 0x00000290 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3040	success	0
1619781070.577212 NtResumeThread	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 3040	success	0
1619788721.04375 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 3040	success	0
1619788721.10675 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 3040	success	0
1619788722.54375 CreateProcessInternalW	thread_identifier: 3056 thread_handle: 0x000001f4 process_identifier: 2984 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6982.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x000001f8 inherit_handles: 1	success	1
1619788725.51275 NtResumeThread	thread_handle: 0x00000288 suspend_count: 1 process_identifier: 3040	success	0
1619788725.88775 NtResumeThread	thread_handle: 0x000002d4 suspend_count: 1 process_identifier: 3040	success	0
1619788726.01275 NtResumeThread	thread_handle: 0x000002dc suspend_count: 1 process_identifier: 3040	success	0
1619788727.02875 NtResumeThread	thread_handle: 0x0000035c suspend_count: 1 process_identifier: 3040	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
McAfee	Fareit-FSX!987972FA824F
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2003742
K7AntiVirus	Trojan ( 00565c521 )
Alibaba	Backdoor:Win32/AgentTesla.9f0c0a4a
K7GW	Trojan ( 00565c521 )
Cybereason	malicious.a824fa
Cyren	W32/MSIL_Kryptik.AQF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.NanoBot.gen
BitDefender	Trojan.GenericKD.43072317
NANO-Antivirus	Trojan.Win32.Kryptik.hjrgew
MicroWorld-eScan	Trojan.GenericKD.43072317
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Trojan.GenericKD.43072317
Emsisoft	Trojan.GenericKD.43072317 (B)
Comodo	Malware@#n5l701dlcu54
F-Secure	Trojan.TR/AD.Nanocore.biwgy
DrWeb	Trojan.DownLoader33.37939
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R066C0DHK20
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
FireEye	Generic.mg.987972fa824faf9e
Sophos	Mal/Generic-R + Troj/nanoCo-AJJ
Ikarus	Trojan.MSIL.Inject
GData	Trojan.GenericKD.43072317
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/AD.Nanocore.biwgy
Antiy-AVL	Trojan[Backdoor]/MSIL.NanoBot
Gridinsoft	Trojan.Win32.Gen.vb
Arcabit	Trojan.Generic.D2913B3D
AegisLab	Trojan.MSIL.NanoBot.m!c
ZoneAlarm	HEUR:Backdoor.MSIL.NanoBot.gen
Microsoft	Trojan:Win32/AgentTesla.E!MTB
AhnLab-V3	Trojan/Win32.AgentTesla.R335088
BitDefenderTheta	Gen:NN.ZemsilF.34700.Km0@autFs0b
ALYac	Trojan.GenericKD.43072317
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Spyware.Agent
ESET-NOD32	a variant of MSIL/Kryptik.VRL
TrendMicro-HouseCall	TROJ_GEN.R066C0DHK20
Tencent	Win32.Trojan.Inject.Auto
Yandex	Trojan.Igent.bTEojU.21
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_84%
Fortinet	MSIL/GenKryptik.EJNX!tr

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-30 15:15:07

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dealbaba.ddns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	50002	8.8.4.4	53
192.168.56.101	51808	8.8.4.4	53
192.168.56.101	53380	8.8.4.4	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.