SmartHawk

6.4

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

a585796634217ff4ab444ea95d43a01a1aa4b3a280b41eaea0e42223e491efae

a0bc75d72a1f793ef46893f919ef5791.exe

分析耗时

92s

最近分析

文件大小

35.5KB

静态报毒动态报毒 100% AI SCORE=100 AUTOIT BLADABI BLADABINDI CLOUD CMW@AOCPPSH CONFIDENCE DOWNLOADER32 EF@4R4NNA ELDORADO FIGN GDSDA GEN8 HBIYGK HIGH CONFIDENCE HWMAOPQA LLQY MALICIOUS PE NJRAT R + MAL RATENJAY SAVE SCORE STATIC AI SUSGEN TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trojan-FIGN	20210412	6.0.6.653
Alibaba	Backdoor:MSIL/Bladabindi.60e479e8	20190527	0.3.0.5
Baidu	MSIL.Backdoor.Bladabindi.a	20190318	1.0.0.2
Avast	MSIL:Agent-CTT [Trj]	20210412	21.1.5827.0
Tencent	Win32.Trojan.Spy.Llqy	20210412	1.0.0.1
Kingsoft		20210412	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619816051.40725 IsDebuggerPresent		failed	0	0
1619816054.079 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619816065.923375 WriteConsoleA	buffer: ÖØÒªÐÅÏ¢: ÒÑ³É¹¦Ö´ÐÐÃüÁî¡£ µ«²»ÔÞ³ÉÊ¹ÓÃ "netsh firewall"£» ¶øÓ¦¸ÃÊ¹ÓÃ "netsh advfirewall firewall"¡£ ÓÐ¹ØÊ¹ÓÃ "netsh advfirewall firewall" ÃüÁî ¶ø·Ç "netsh firewall" µÄÏêÏ¸ÐÅÏ¢£¬Çë²ÎÔÄ http://go.microsoft.com/fwlink/?linkid=121488 ÉÏµÄ KB ÎÄÕÂ 947709¡£ console_handle: 0x00000007	success	1	0
1619816065.923375 WriteConsoleA	buffer: È·¶¨¡£ console_handle: 0x00000007	success	1	0

Connects to a Dynamic DNS Domain (1 个事件)

domain

mammoth01.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (48 个事件)

Time & API	Arguments	Status
1619816050.78225 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006b0000	success
1619816050.78225 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00810000	success
1619816051.37625 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619816051.40725 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052a000	success
1619816051.40725 NtProtectVirtualMemory	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619816051.40725 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00522000	success
1619816051.62625 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success
1619816051.65725 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00533000	success
1619816051.65725 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056b000	success
1619816051.65725 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00567000	success
1619816051.68925 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053c000	success
1619816051.89225 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00534000	success
1619816052.23625 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00535000	success
1619816052.23625 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success
1619816052.31425 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success
1619816052.31425 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619816052.39225 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success
1619816052.57925 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00565000	success
1619816052.81425 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b1000	success
1619816053.14225 NtAllocateVirtualMemory	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success
1619816054.048 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00650000	success
1619816054.048 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00760000	success
1619816054.064 NtProtectVirtualMemory	process_identifier: 1436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619816054.079 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057a000	success
1619816054.079 NtProtectVirtualMemory	process_identifier: 1436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619816054.079 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00572000	success
1619816054.095 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00582000	success
1619816054.095 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00583000	success
1619816054.095 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bb000	success
1619816054.095 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b7000	success
1619816054.095 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058c000	success
1619816054.126 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00584000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00585000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00586000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b40000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005aa000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a2000	success
1619816054.142 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b5000	success
1619816054.157 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b41000	success
1619816054.236 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success
1619816054.751 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057b000	success
1619816059.642 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00596000	success
1619816059.642 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059a000	success
1619816059.642 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619816060.314 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04700000	success
1619816064.611 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04701000	success
1619816068.548 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00573000	success
1619816068.704 NtAllocateVirtualMemory	process_identifier: 1436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b42000	success

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619816059.642 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

netsh firewall add allowedprogram "C:\ProgramData\chrome.exe" "chrome.exe" ENABLE

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (50 out of 116 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c86dde540c78abe630dfe951b22ac3e0	reg_value	"C:\ProgramData\chrome.exe" ..

One or more non-safelisted processes were created (1 个事件)

parent_process

chrome.exe

martian_process

netsh firewall add allowedprogram "C:\ProgramData\chrome.exe" "chrome.exe" ENABLE

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
ClamAV	Win.Trojan.B-468
Qihoo-360	Win32/Backdoor.NjRAT.HwMAOPQA
McAfee	Trojan-FIGN
Cylance	Unsafe
Zillya	Trojan.Bladabindi.Win32.109543
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
Alibaba	Backdoor:MSIL/Bladabindi.60e479e8
K7GW	Trojan ( 700000121 )
Cybereason	malicious.72a1f7
Arcabit	Generic.MSIL.Bladabindi.2D774ABE
Baidu	MSIL.Backdoor.Bladabindi.a
Cyren	W32/MSIL_Bladabindi.A.gen!Eldorado
Symantec	Backdoor.Ratenjay
ESET-NOD32	a variant of MSIL/Bladabindi.AS
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.MSIL.Bladabindi.2D774ABE
NANO-Antivirus	Trojan.Win32.Gen8.hbiygk
MicroWorld-eScan	Generic.MSIL.Bladabindi.2D774ABE
Avast	MSIL:Agent-CTT [Trj]
Tencent	Win32.Trojan.Spy.Llqy
Ad-Aware	Generic.MSIL.Bladabindi.2D774ABE
Emsisoft	Generic.MSIL.Bladabindi.2D774ABE (B)
Comodo	TrojWare.MSIL.Spy.Agent.EF@4r4nna
DrWeb	Trojan.DownLoader32.53633
VIPRE	Backdoor.MSIL.Bladabindi.a (v)
TrendMicro	BKDR_BLADABI.SMC
McAfee-GW-Edition	BehavesLike.Win32.Trojan.nm
FireEye	Generic.mg.a0bc75d72a1f793e
Sophos	Mal/Generic-R + Mal/Bladabi-D
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDropper.Autoit.dce
Avira	TR/Spy.Gen8
MAX	malware (ai score=100)
Microsoft	Backdoor:MSIL/Bladabindi.AJ
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	MSIL.Trojan-Spy.Bladabindi.BQ
AhnLab-V3	Trojan/Win32.RL_Generic.C3541645
Acronis	suspicious
VBA32	TScope.Trojan.MSIL
ALYac	Generic.MSIL.Bladabindi.2D774ABE
Malwarebytes	Backdoor.Bladabindi
TrendMicro-HouseCall	BKDR_BLADABI.SMC
Rising	Backdoor.Njrat!1.9E49 (CLOUD)
Ikarus	Backdoor.MSIL.Bladabindi

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-02-19 01:12:37

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1
mammoth01.ddns.net	A 0.0.0.0	0.0.0.0

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.