SmartHawk

9.6

极危

该样本未表现出任何异常！

重新分析

下载样本

96ad1757a83a77fa0b160a760613ee61a39cea4e5adb3e91ebda43653a770739

a645004e2c3d388e67ec12f02b3321a0.exe

分析耗时

147s

最近分析

文件大小

571.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825861.770499 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619825865.879499 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825786.364249 IsDebuggerPresent		failed	0	0
1619825786.364249 IsDebuggerPresent		failed	0	0
1619825844.582499 IsDebuggerPresent		failed	0	0
1619825844.582499 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825786.442249 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:2436774192&cup2hreq=2bd9f510b7ea11f1a85858aed671fe4b529ff549acd1057a3263294e0506fc47

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:2436774192&cup2hreq=2bd9f510b7ea11f1a85858aed671fe4b529ff549acd1057a3263294e0506fc47

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:2436774192&cup2hreq=2bd9f510b7ea11f1a85858aed671fe4b529ff549acd1057a3263294e0506fc47

Allocates read-write-execute memory (usually to unpack itself) (50 out of 146 个事件)

Time & API	Arguments	Status
1619825785.489249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006f0000	success
1619825785.489249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00810000	success
1619825786.255249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b70000	success
1619825786.255249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf0000	success
1619825786.302249 NtProtectVirtualMemory	process_identifier: 1912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619825786.364249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00600000	success
1619825786.364249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success
1619825786.364249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success
1619825786.395249 NtProtectVirtualMemory	process_identifier: 1912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619825786.395249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619825786.708249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00572000	success
1619825786.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00595000	success
1619825786.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success
1619825786.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619825787.083249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00573000	success
1619825787.364249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00574000	success
1619825787.395249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00575000	success
1619825787.567249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057c000	success
1619825790.895249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00576000	success
1619825791.052249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00578000	success
1619825791.442249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f0000	success
1619825791.739249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success
1619825791.739249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00587000	success
1619825791.942249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00579000	success
1619825791.958249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb0000	success
1619825791.989249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00586000	success
1619825792.114249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f1000	success
1619825792.114249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb1000	success
1619825792.130249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb2000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef48000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef30000	success
1619825792.161249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef30000	success
1619825792.505249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cf1000	success
1619825792.630249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb3000	success
1619825792.630249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f2000	success
1619825792.817249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057d000	success
1619825792.817249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb4000	success
1619825792.880249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f3000	success
1619825792.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f4000	success
1619825792.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb5000	success
1619825792.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success
1619825792.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success
1619825792.927249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f5000	success
1619825792.942249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f8000	success
1619825792.989249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f9000	success
1619825793.020249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007fa000	success
1619825793.020249 NtAllocateVirtualMemory	process_identifier: 1912 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb6000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8433334130003844

section

{'size_of_data': '0x0008dc00', 'virtual_address': '0x00002000', 'entropy': 7.8433334130003844, 'name': '.text', 'virtual_size': '0x0008db0c'}

description

A section with a high entropy has been found

entropy

0.9929947460595446

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825861.082499 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825843.536249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000220 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL_àNÎl @ À@lKH H.textÔL N `.rsrcHP@@.reloc V@B process_handle: 0x00000220 base_address: 0x00400000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: P8h ¼\ê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion0.0.0.0tInternalNameJkhaNlflOGYToqRakKuctLMycsuTGEDUhNvQG.exe(LegalCopyright \|OriginalFilenameJkhaNlflOGYToqRakKuctLMycsuTGEDUhNvQG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x00000220 base_address: 0x00448000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: `Ð< process_handle: 0x00000220 base_address: 0x0044a000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: @ process_handle: 0x00000220 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL_àNÎl @ À@lKH H.textÔL N `.rsrcHP@@.reloc V@B process_handle: 0x00000220 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1912 called NtSetContextThread to modify thread in remote process 2856
1619825843.536249 NtSetContextThread	thread_handle: 0x0000021c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484302 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2856	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1912 resumed a thread in remote process 2856
1619825843.677249 NtResumeThread	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 2856	success	0	0

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619825786.364249 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1912	success	0
1619825786.427249 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 1912	success	0
1619825786.458249 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1912	success	0
1619825843.536249 CreateProcessInternalW	thread_identifier: 1324 thread_handle: 0x0000021c process_identifier: 2856 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a645004e2c3d388e67ec12f02b3321a0.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a645004e2c3d388e67ec12f02b3321a0.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x00000220 inherit_handles: 0	success	1
1619825843.536249 NtGetContextThread	thread_handle: 0x0000021c	success	0
1619825843.536249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000220 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL_àNÎl @ À@lKH H.textÔL N `.rsrcHP@@.reloc V@B process_handle: 0x00000220 base_address: 0x00400000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: process_handle: 0x00000220 base_address: 0x00402000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: P8h ¼\ê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion0.0.0.0tInternalNameJkhaNlflOGYToqRakKuctLMycsuTGEDUhNvQG.exe(LegalCopyright \|OriginalFilenameJkhaNlflOGYToqRakKuctLMycsuTGEDUhNvQG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x00000220 base_address: 0x00448000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: `Ð< process_handle: 0x00000220 base_address: 0x0044a000	success	1
1619825843.536249 WriteProcessMemory	process_identifier: 2856 buffer: @ process_handle: 0x00000220 base_address: 0x7efde008	success	1
1619825843.536249 NtSetContextThread	thread_handle: 0x0000021c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4484302 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2856	success	0
1619825843.677249 NtResumeThread	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 2856	success	0
1619825843.677249 NtResumeThread	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 1912	success	0
1619825844.582499 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2856	success	0
1619825844.598499 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2856	success	0
1619825844.598499 NtResumeThread	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2856	success	0
1619825865.707499 NtResumeThread	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2856	success	0
1619825865.770499 NtResumeThread	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2856	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-17 18:15:46

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.27.142	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.98	203.208.40.98
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49189	203.208.40.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	58970	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	54178	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.