SmartHawk

Time & API	Arguments	Status	Return	Repeated
1620849292.040124 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75331000	success	0	0
1620849292.040124 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76881000	success	0	0

Foreign language identified in PE resource (10 个事件)

name

EXE

language

LANG_CHINESE

offset

0x0003a310

filetype

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x001ef578

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00243ce8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00244150

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000068

name

RT_VERSION

language

LANG_CHINESE

offset

0x002441b8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000002f4

Creates executable files on the filesystem (14 个事件)

file	C:\Program Files (x86)\SogouSoftware\download\download\MiniThunderPlatform.exe
file	C:\Program Files (x86)\SogouSoftware\download\download\MiniTPFw.exe
file	C:\Program Files (x86)\SogouSoftware\download\download\msvcr71.dll
file	C:\Program Files (x86)\SogouSoftware\crash\ExceptionReport.exe
file	C:\Program Files (x86)\SogouSoftware\download\xldl.dll
file	C:\Program Files (x86)\SogouSoftware\download\download\msvcp71.dll
file	C:\Program Files (x86)\SogouSoftware\download\download\ThunderFW.exe
file	C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\minidownload.exe
file	C:\Program Files (x86)\SogouSoftware\download\download\download_engine.dll
file	C:\Program Files (x86)\SogouSoftware\download\download\atl71.dll
file	C:\Program Files (x86)\SogouSoftware\download\download\zlib1.dll
file	C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dll
file	C:\Program Files (x86)\SogouSoftware\download\download\dl_peer_id.dll

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\minidownload.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\minidownload.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.935676122614296

section

{'size_of_data': '0x0020a800', 'virtual_address': '0x0003a000', 'entropy': 7.935676122614296, 'name': '.rsrc', 'virtual_size': '0x0020a638'}

description

A section with a high entropy has been found

entropy

0.9002799913848805

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (3 个事件)

host	113.108.239.196
host	172.217.24.14
host	203.208.41.66

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2344 resumed a thread in remote process 2056
1620808838.358875 NtResumeThread	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 2056	success	0	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-04-18 21:10:46

Imports

Library KERNEL32.dll:

• 0x42d020 CloseHandle

• 0x42d024 DebugBreak

• 0x42d028 GetCommandLineW

• 0x42d02c GetTempPathW

• 0x42d030 CompareStringW

• 0x42d034 GetProcessHeap

• 0x42d038 SetEndOfFile

• 0x42d03c WriteConsoleW

• 0x42d040 SetStdHandle

• 0x42d044 SetFilePointer

• 0x42d048 lstrlenW

• 0x42d04c PeekNamedPipe

• 0x42d050 GetFileInformationByHandle

• 0x42d054 GetFullPathNameW

• 0x42d058 GetTimeZoneInformation

• 0x42d05c FlushFileBuffers

• 0x42d060 GetConsoleMode

• 0x42d064 GetConsoleCP

• 0x42d068 FindFirstFileExW

• 0x42d06c GetDriveTypeW

• 0x42d070 FileTimeToLocalFileTime

• 0x42d074 FileTimeToSystemTime

• 0x42d078 CreateThread

• 0x42d07c ExitThread

• 0x42d080 MultiByteToWideChar

• 0x42d084 CreateFileW

• 0x42d088 WriteFile

• 0x42d08c OutputDebugStringW

• 0x42d090 InterlockedDecrement

• 0x42d094 InterlockedIncrement

• 0x42d098 lstrlenA

• 0x42d09c LockResource

• 0x42d0a0 SizeofResource

• 0x42d0a4 GetModuleHandleW

• 0x42d0a8 LoadResource

• 0x42d0ac FindResourceW

• 0x42d0b0 GetCurrentDirectoryW

• 0x42d0b4 FreeResource

• 0x42d0b8 CreateFileA

• 0x42d0bc CreateMutexW

• 0x42d0c0 lstrcmpW

• 0x42d0c4 GetSystemDirectoryW

• 0x42d0c8 DeviceIoControl

• 0x42d0cc ReadFile

• 0x42d0d0 CopyFileW

• 0x42d0d4 GetLastError

• 0x42d0d8 HeapFree

• 0x42d0dc HeapSetInformation

• 0x42d0e0 GetStartupInfoW

• 0x42d0e4 RaiseException

• 0x42d0e8 TerminateProcess

• 0x42d0ec GetCurrentProcess

• 0x42d0f0 UnhandledExceptionFilter

• 0x42d0f4 SetUnhandledExceptionFilter

• 0x42d0f8 IsDebuggerPresent

• 0x42d0fc HeapAlloc

• 0x42d100 IsProcessorFeaturePresent

• 0x42d104 EncodePointer

• 0x42d108 DecodePointer

• 0x42d10c HeapCreate

• 0x42d110 GetCPInfo

• 0x42d114 GetACP

• 0x42d118 GetOEMCP

• 0x42d11c IsValidCodePage

• 0x42d120 TlsAlloc

• 0x42d124 TlsGetValue

• 0x42d128 TlsSetValue

• 0x42d12c TlsFree

• 0x42d130 SetLastError

• 0x42d134 GetCurrentThreadId

• 0x42d138 GetProcAddress

• 0x42d13c LCMapStringW

• 0x42d140 GetStringTypeW

• 0x42d144 ExitProcess

• 0x42d148 GetStdHandle

• 0x42d14c GetModuleFileNameW

• 0x42d150 FreeEnvironmentStringsW

• 0x42d154 GetEnvironmentStringsW

• 0x42d158 SetHandleCount

• 0x42d15c InitializeCriticalSectionAndSpinCount

• 0x42d160 GetFileType

• 0x42d164 DeleteCriticalSection

• 0x42d168 QueryPerformanceCounter

• 0x42d16c GetTickCount

• 0x42d170 GetCurrentProcessId

• 0x42d174 GetSystemTimeAsFileTime

• 0x42d178 LeaveCriticalSection

• 0x42d17c EnterCriticalSection

• 0x42d180 RtlUnwind

• 0x42d184 Sleep

• 0x42d188 HeapSize

• 0x42d18c WideCharToMultiByte

• 0x42d190 GetUserDefaultLCID

• 0x42d194 GetLocaleInfoW

• 0x42d198 GetLocaleInfoA

• 0x42d19c EnumSystemLocalesA

• 0x42d1a0 IsValidLocale

• 0x42d1a4 FreeLibrary

• 0x42d1a8 InterlockedExchange

• 0x42d1ac LoadLibraryW

• 0x42d1b0 HeapReAlloc

• 0x42d1b4 GetEnvironmentVariableW

• 0x42d1b8 CreateDirectoryW

• 0x42d1bc GetPrivateProfileStringW

• 0x42d1c0 WaitForSingleObject

• 0x42d1c4 OutputDebugStringA

• 0x42d1c8 InitializeCriticalSection

• 0x42d1cc FindFirstFileW

• 0x42d1d0 FindNextFileW

• 0x42d1d4 FindClose

• 0x42d1d8 GetVersionExW

• 0x42d1dc GetLocalTime

• 0x42d1e0 CreateEventW

• 0x42d1e4 CreateSemaphoreW

• 0x42d1e8 ResetEvent

• 0x42d1ec ReleaseSemaphore

• 0x42d1f0 SetEvent

• 0x42d1f4 WaitForMultipleObjects

• 0x42d1f8 DeleteFileW

• 0x42d1fc lstrcpynW

• 0x42d200 lstrcpyW

• 0x42d204 GetFileSize

• 0x42d208 SetEnvironmentVariableA

Library USER32.dll:

• 0x42d258 wvsprintfW

• 0x42d25c wsprintfW

• 0x42d260 CharNextW

• 0x42d264 LoadStringW

Library SHELL32.dll:

• 0x42d228 ShellExecuteExW

• 0x42d22c ShellExecuteW

• 0x42d230 SHGetSpecialFolderPathW

• 0x42d234 SHFileOperationW

Library ole32.dll:

• 0x42d2a8 CoInitialize

• 0x42d2ac CoGetClassObject

• 0x42d2b0 CoCreateGuid

• 0x42d2b4 CoUninitialize

Library SHLWAPI.dll:

• 0x42d23c StrCpyW

• 0x42d240 PathIsDirectoryW

• 0x42d244 PathFileExistsW

• 0x42d248 SHSetValueW

• 0x42d24c SHGetValueW

• 0x42d250 PathAppendW

Library PSAPI.DLL:

• 0x42d220 GetModuleBaseNameW

Library WININET.dll:

• 0x42d27c InternetConnectW

• 0x42d280 InternetCloseHandle

• 0x42d284 InternetOpenW

• 0x42d288 InternetSetOptionW

• 0x42d28c InternetQueryDataAvailable

• 0x42d290 HttpQueryInfoW

• 0x42d294 InternetCrackUrlW

• 0x42d298 HttpSendRequestW

• 0x42d29c HttpOpenRequestW

• 0x42d2a0 InternetReadFile

Library VERSION.dll:

• 0x42d26c VerQueryValueW

• 0x42d270 GetFileVersionInfoSizeW

• 0x42d274 GetFileVersionInfoW

Library NETAPI32.dll:

• 0x42d210 NetApiBufferFree

• 0x42d214 NetWkstaTransportEnum

• 0x42d218 Netbios

Library ADVAPI32.dll:

• 0x42d000 RegOpenKeyExA

• 0x42d004 RegCloseKey

• 0x42d008 OpenSCManagerW

• 0x42d00c OpenServiceW

• 0x42d010 QueryServiceStatus

• 0x42d014 CloseServiceHandle

• 0x42d018 RegQueryValueExA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
203.208.41.66	443	192.168.56.101	49187

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.