SmartHawk

10.2

0-day

56 个模型检测该样本为恶意！

重新分析

下载样本

b8857292907964728bf2613f9a49f29571ac621e1903f74bff08841efa93ab01

a4d8438130cc70821ecd8a71c1393521.exe

分析耗时

128s

最近分析

文件大小

433.0KB

静态报毒动态报毒 100% AGENSLA AGENTTESLA APCW ATTRIBUTE CLOUD CONFIDENCE DOWNLOADER34 ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE HRAMXD IGENERIC KRYPT KRYPTIK LNXW MALICIOUS PE R002C0TH820 R347247 SCORE SUSGEN TROJANX TSCOPE UNCLASSIFIEDMALWARE@0 UNSAFE ZVOGI 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:MSIL/AgentTesla.7eca014b	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20200820	18.4.3895.0
Kingsoft		20200820	2013.8.14.323
McAfee	Fareit-FVT!A4D8438130CC	20200820	6.0.6.653
Tencent	Win32.Trojan.Generic.Lnxw	20200820	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks if process is being debugged by a debugger (3 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781474.843375 IsDebuggerPresent		failed	0	0
1619781522.827375 IsDebuggerPresent		failed	0	0
1619817184.991001 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781518.312375 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 110 个事件)

Time & API	Arguments	Status	Return
1619781474.249375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006f0000	success	0
1619781474.249375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00850000	success	0
1619781474.796375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success	0
1619781474.859375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success	0
1619781474.859375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success	0
1619781474.859375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success	0
1619781475.140375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00542000	success	0
1619781475.187375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00543000	success	0
1619781475.187375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057b000	success	0
1619781475.187375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00577000	success	0
1619781475.218375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054c000	success	0
1619781476.046375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00544000	success	0
1619781476.046375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00545000	success	0
1619781476.062375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00546000	success	0
1619781476.077375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d0000	success	0
1619781476.140375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success	0
1619781476.140375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00557000	success	0
1619781476.140375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success	0
1619781476.171375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053b000	success	0
1619781476.452375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00556000	success	0
1619781476.452375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success	0
1619781476.734375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success	0
1619781476.765375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00575000	success	0
1619781476.905375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d1000	success	0
1619781476.921375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00547000	success	0
1619781517.984375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d2000	success	0
1619781518.015375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04700000	success	0
1619781518.015375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00851000	success	0
1619781518.202375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d3000	success	0
1619781518.374375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success	0
1619781518.390375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d4000	success	0
1619781518.499375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00548000	success	0
1619781518.515375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d5000	success	0
1619781518.687375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd0400	failed	3221225550
1619781522.280375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00549000	success	0
1619781522.280375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d7000	success	0
1619781522.312375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d8000	success	0
1619781522.343375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007d9000	success	0
1619781522.484375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007da000	success	0
1619781522.562375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007db000	success	0
1619781522.609375 NtAllocateVirtualMemory	process_identifier: 1824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007dc000	success	0
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd0178	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd01a0	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd01c8	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd01f0	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04bd0218	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04c16cee	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04c16ce2	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04c16400	failed	3221225550
1619781522.609375 NtProtectVirtualMemory	process_identifier: 1824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04c16cfc	failed	3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.916957912079504

section

{'size_of_data': '0x0006ba00', 'virtual_address': '0x00002000', 'entropy': 7.916957912079504, 'name': '.text', 'virtual_size': '0x0006b934'}

description

A section with a high entropy has been found

entropy

0.9953757225433526

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781518.687375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781523.062375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 952 process_handle: 0x00008724	failed	0	0
1619781523.062375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 952 process_handle: 0x00008724	success	0	0

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781522.937375 NtAllocateVirtualMemory	process_identifier: 952 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000560c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619781523.124375 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000f098 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1824 manipulating memory of non-child process 952
1619781522.937375 NtAllocateVirtualMemory	process_identifier: 952 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000560c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619781523.124375 WriteProcessMemory	process_identifier: 1324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL}$_àP^n @ À@nKè H.textdN P `.rsrcèR@@.reloc V@B process_handle: 0x0000f098 base_address: 0x00400000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNameduykszsZUsnbQnnlgBwUVHAaZ.exe(LegalCopyright dOriginalFilenameduykszsZUsnbQnnlgBwUVHAaZ.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000f098 base_address: 0x00448000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: ``> process_handle: 0x0000f098 base_address: 0x0044a000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: @ process_handle: 0x0000f098 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781523.124375 WriteProcessMemory	process_identifier: 1324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL}$_àP^n @ À@nKè H.textdN P `.rsrcèR@@.reloc V@B process_handle: 0x0000f098 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1824 called NtSetContextThread to modify thread in remote process 1324
1619781523.140375 NtSetContextThread	thread_handle: 0x00008724 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484702 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1324	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1824 resumed a thread in remote process 1324
1619781523.187375 NtResumeThread	thread_handle: 0x00008724 suspend_count: 1 process_identifier: 1324	success	0	0

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619781474.843375 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1824	success	0
1619781474.937375 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 1824	success	0
1619781522.796375 NtResumeThread	thread_handle: 0x0000c93c suspend_count: 1 process_identifier: 1824	success	0
1619781522.812375 NtResumeThread	thread_handle: 0x0000c434 suspend_count: 1 process_identifier: 1824	success	0
1619781522.937375 CreateProcessInternalW	thread_identifier: 1832 thread_handle: 0x00002084 process_identifier: 952 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a4d8438130cc70821ecd8a71c1393521.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a4d8438130cc70821ecd8a71c1393521.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000560c inherit_handles: 0	success	1
1619781522.937375 NtGetContextThread	thread_handle: 0x00002084	success	0
1619781522.937375 NtAllocateVirtualMemory	process_identifier: 952 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000560c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619781523.124375 CreateProcessInternalW	thread_identifier: 2760 thread_handle: 0x00008724 process_identifier: 1324 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a4d8438130cc70821ecd8a71c1393521.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a4d8438130cc70821ecd8a71c1393521.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000f098 inherit_handles: 0	success	1
1619781523.124375 NtGetContextThread	thread_handle: 0x00008724	success	0
1619781523.124375 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000f098 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619781523.124375 WriteProcessMemory	process_identifier: 1324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL}$_àP^n @ À@nKè H.textdN P `.rsrcèR@@.reloc V@B process_handle: 0x0000f098 base_address: 0x00400000	success	1
1619781523.124375 WriteProcessMemory	process_identifier: 1324 buffer: process_handle: 0x0000f098 base_address: 0x00402000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNameduykszsZUsnbQnnlgBwUVHAaZ.exe(LegalCopyright dOriginalFilenameduykszsZUsnbQnnlgBwUVHAaZ.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000f098 base_address: 0x00448000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: ``> process_handle: 0x0000f098 base_address: 0x0044a000	success	1
1619781523.140375 WriteProcessMemory	process_identifier: 1324 buffer: @ process_handle: 0x0000f098 base_address: 0x7efde008	success	1
1619781523.140375 NtSetContextThread	thread_handle: 0x00008724 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484702 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1324	success	0
1619781523.187375 NtResumeThread	thread_handle: 0x00008724 suspend_count: 1 process_identifier: 1324	success	0
1619817184.991001 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1324	success	0
1619817184.991001 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1324	success	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43618659
FireEye	Generic.mg.a4d8438130cc7082
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Spyware.AgentTesla
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.1168790
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c26d1 )
Alibaba	Trojan:MSIL/AgentTesla.7eca014b
K7GW	Trojan ( 0056c26d1 )
Cybereason	malicious.ffad1a
Invincea	heuristic
F-Prot	W32/MSIL_Kryptik.BJF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
GData	Trojan.GenericKD.43618659
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.43618659
NANO-Antivirus	Trojan.Win32.Kryptik.hramxd
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Kryptik.443392.EK
Rising	Trojan.AgentTesla!8.104D5 (CLOUD)
Ad-Aware	Trojan.GenericKD.43618659
Emsisoft	Trojan.GenericKD.43618659 (B)
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Kryptik.zvogi
DrWeb	Trojan.DownLoader34.18893
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0TH820
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/MSIL_Kryptik.BJF.gen!Eldorado
Jiangmin	Trojan.PSW.MSIL.apcw
Avira	TR/Kryptik.zvogi
eGambit	Unsafe.AI_Score_96%
Antiy-AVL	Trojan/MSIL.Kryptik
AegisLab	Trojan.Win32.Malicious.4!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.MSIL.R347247
McAfee	Fareit-FVT!A4D8438130CC
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XHF
TrendMicro-HouseCall	TROJ_GEN.R002C0TH820
Tencent	Win32.Trojan.Generic.Lnxw
Ikarus	Trojan.MSIL.Krypt

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-08 04:12:49

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.