11.0
0-day
59 个模型检测该样本为恶意！
重新分析
更多

e69ef837a837058a9717c85c8bf58e7289f5d083ff7be84d79f52113d661bc21

a6d7dab94fc0c16002f3cab28bd45818.exe

分析耗时

93s

最近分析

文件大小

984.5KB
静态报毒 动态报毒 100% 9GW@AO9MRKNI AI SCORE=80 AIDETECTVM ALI2000015 BXXJ CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY EMRT FAREIT GENETIC HIGH CONFIDENCE HOACQX IS6AZZBBOWE KCLOUD KRYPTIK LOKI MALWARE2 MALWARE@#2N8S8R98FVCZM PWSX REMCOS SCORE SMAD1 SPYBOTNET SUSGEN TSCOPE UNSAFE X2094 XOGCY ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVZ!A6D7DAB94FC0 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Tencent 20201211 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (12 个事件)
Time & API Arguments Status Return Repeated
1619853206.339499
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdcf1485
success 0 0
1619853214.667
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb21485
success 0 0
1619853219.730625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff681485
success 0 0
1619853225.042125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb71485
success 0 0
1619853230.573374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff471485
success 0 0
1619853240.652875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdba1485
success 0 0
1619853245.902499
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd951485
success 0 0
1619853249.808625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff401485
success 0 0
1619853254.85575
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff501485
success 0 0
1619853258.73
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff321485
success 0 0
1619853264.073
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4c1485
success 0 0
1619853269.73025
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
dyeuiwo+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4c1485
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 372 个事件)
Time & API Arguments Status Return Repeated
1619826884.609212
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619826884.796212
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619826884.812212
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00790000
success 0 0
1619853204.292374
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619853204.308374
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619853204.308374
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00830000
success 0 0
1619853205.339499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619853205.386499
NtAllocateVirtualMemory
process_identifier: 648
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02100000
success 0 0
1619853205.386499
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02220000
success 0 0
1619853205.386499
NtAllocateVirtualMemory
process_identifier: 648
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02000000
success 0 0
1619853205.386499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02002000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619853206.323499
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853205.777374
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619853205.964374
NtProtectVirtualMemory
process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619853205.964374
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020f0000
success 0 0
1619853212.917875
NtAllocateVirtualMemory
process_identifier: 1068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619853213.027875
NtProtectVirtualMemory
process_identifier: 1068
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619853213.027875
NtAllocateVirtualMemory
process_identifier: 1068
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f00000
success 0 0
1619853214.542
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619853214.542
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f80000
success 0 0
1619853214.542
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02130000
success 0 0
1619853214.542
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f80000
success 0 0
1619853214.542
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f82000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619853214.62
NtProtectVirtualMemory
process_identifier: 2032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (16 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.555728607911495 section {'size_of_data': '0x00071e00', 'virtual_address': '0x0008a000', 'entropy': 7.555728607911495, 'name': '.rsrc', 'virtual_size': '0x00071d40'} description A section with a high entropy has been found
entropy 0.46314184036603967 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process dyeuiwo.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 个事件)
Time & API Arguments Status Return Repeated
1619826884.827212
Process32NextW
process_name: a6d7dab94fc0c16002f3cab28bd45818.exe
snapshot_handle: 0x000000f8
process_identifier: 3040
failed 0 0
1619853204.339374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 2264
failed 0 0
1619853205.980374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2452
failed 0 0
1619853212.245374
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000190
process_identifier: 2468
failed 0 0
1619853213.042875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3068
failed 0 0
1619853215.292499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2900
failed 0 0
1619853216.698499
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x0000011c
process_identifier: 2116
failed 0 0
1619853217.995499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 624
failed 0 0
1619853220.152125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1816
failed 0 0
1619853222.214125
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000134
process_identifier: 880
failed 0 0
1619853223.198
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2968
failed 0 0
1619853225.48
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3080
failed 0 0
1619853227.933
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000138
process_identifier: 1688
failed 0 0
1619853229.433
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x000000f8
process_identifier: 3100
failed 0 0
1619853231.198875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3340
failed 0 0
1619853233.448875
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000128
process_identifier: 3248
failed 0 0
1619853234.464374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3412
failed 0 0
1619853241.308875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3780
failed 0 0
1619853243.636875
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000130
process_identifier: 3688
failed 0 0
1619853244.55875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3848
failed 0 0
1619853246.292374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 4028
failed 0 0
1619853247.823374
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000124
process_identifier: 3932
failed 0 0
1619853248.40225
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3008
failed 0 0
1619853250.308875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3232
failed 0 0
1619853252.089875
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000124
process_identifier: 3128
failed 0 0
1619853253.41725
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1376
failed 0 0
1619853255.02775
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x000000f8
process_identifier: 3548
failed 0 0
1619853256.41775
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x0000011c
process_identifier: 3548
failed 0 0
1619853257.5115
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3420
failed 0 0
1619853259.308125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3788
failed 0 0
1619853261.261125
Process32NextW
process_name: dyeuiwo.exe
snapshot_handle: 0x00000124
process_identifier: 3888
failed 0 0
1619853262.214374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3568
failed 0 0
1619853264.636374
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x000000f8
process_identifier: 2272
failed 0 0
1619853266.542374
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000124
process_identifier: 2272
failed 0 0
1619853267.652625
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f8
process_identifier: 4040
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619826885.609212
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3040 created a thread in remote process 2868
Time & API Arguments Status Return Repeated
1619826885.671212
NtQueueApcThread
thread_handle: 0x00000108
process_identifier: 2868
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619826885.609212
WriteProcessMemory
process_identifier: 2868
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619826885.609212
WriteProcessMemory
process_identifier: 2868
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6d7dab94fc0c16002f3cab28bd45818.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6d7dab94fc0c16002f3cab28bd45818.exe" winSet tmXmnWR = creaTeobJEct("wsCriPT.SHeLl") tMxMnwR.RUN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (24 个事件)
Process injection Process 2456 called NtSetContextThread to modify thread in remote process 648
Process injection Process 1068 called NtSetContextThread to modify thread in remote process 2032
Process injection Process 1476 called NtSetContextThread to modify thread in remote process 324
Process injection Process 2772 called NtSetContextThread to modify thread in remote process 708
Process injection Process 3100 called NtSetContextThread to modify thread in remote process 3188
Process injection Process 3352 called NtSetContextThread to modify thread in remote process 3528
Process injection Process 3792 called NtSetContextThread to modify thread in remote process 3868
Process injection Process 4044 called NtSetContextThread to modify thread in remote process 3036
Process injection Process 3088 called NtSetContextThread to modify thread in remote process 1664
Process injection Process 3764 called NtSetContextThread to modify thread in remote process 3524
Process injection Process 4056 called NtSetContextThread to modify thread in remote process 2648
Process injection Process 3704 called NtSetContextThread to modify thread in remote process 3856
Time & API Arguments Status Return Repeated
1619853204.558374
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 648
success 0 0
1619853213.620875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2032
success 0 0
1619853218.980499
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 324
success 0 0
1619853224.152
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 708
success 0 0
1619853229.902
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3188
success 0 0
1619853237.730374
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3528
success 0 0
1619853245.10575
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3868
success 0 0
1619853248.62025
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3036
success 0 0
1619853254.02725
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1664
success 0 0
1619853257.7925
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3524
success 0 0
1619853262.605374
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2648
success 0 0
1619853268.136625
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3856
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (24 个事件)
Process injection Process 2456 resumed a thread in remote process 648
Process injection Process 1068 resumed a thread in remote process 2032
Process injection Process 1476 resumed a thread in remote process 324
Process injection Process 2772 resumed a thread in remote process 708
Process injection Process 3100 resumed a thread in remote process 3188
Process injection Process 3352 resumed a thread in remote process 3528
Process injection Process 3792 resumed a thread in remote process 3868
Process injection Process 4044 resumed a thread in remote process 3036
Process injection Process 3088 resumed a thread in remote process 1664
Process injection Process 3764 resumed a thread in remote process 3524
Process injection Process 4056 resumed a thread in remote process 2648
Process injection Process 3704 resumed a thread in remote process 3856
Time & API Arguments Status Return Repeated
1619853205.089374
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 648
success 0 0
1619853214.308875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2032
success 0 0
1619853219.464499
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 324
success 0 0
1619853224.636
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 708
success 0 0
1619853230.292
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3188
success 0 0
1619853239.730374
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3528
success 0 0
1619853245.55875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3868
success 0 0
1619853249.27725
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3036
success 0 0
1619853254.46425
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 1664
success 0 0
1619853258.1205
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3524
success 0 0
1619853263.698374
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2648
success 0 0
1619853269.027625
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3856
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 100 个事件)
Time & API Arguments Status Return Repeated
1619826885.609212
CreateProcessInternalW
thread_identifier: 2136
thread_handle: 0x00000108
process_identifier: 2868
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619826885.609212
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619826885.609212
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619826885.609212
WriteProcessMemory
process_identifier: 2868
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619826885.609212
WriteProcessMemory
process_identifier: 2868
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6d7dab94fc0c16002f3cab28bd45818.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6d7dab94fc0c16002f3cab28bd45818.exe" winSet tmXmnWR = creaTeobJEct("wsCriPT.SHeLl") tMxMnwR.RUN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619853204.058625
CreateProcessInternalW
thread_identifier: 2620
thread_handle: 0x000000d0
process_identifier: 2456
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619853204.527374
CreateProcessInternalW
thread_identifier: 3048
thread_handle: 0x0000010c
process_identifier: 648
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619853204.527374
NtUnmapViewOfSection
process_identifier: 648
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619853204.527374
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 648
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853204.558374
NtGetContextThread
thread_handle: 0x0000010c
success 0 0
1619853204.558374
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 648
success 0 0
1619853205.089374
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 648
success 0 0
1619853205.230374
CreateProcessInternalW
thread_identifier: 2560
thread_handle: 0x00000110
process_identifier: 2468
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe" 2 648 28889312
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1619853212.620374
CreateProcessInternalW
thread_identifier: 2252
thread_handle: 0x00000194
process_identifier: 1068
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000198
inherit_handles: 0
success 1 0
1619853213.448875
CreateProcessInternalW
thread_identifier: 1056
thread_handle: 0x00000108
process_identifier: 2032
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619853213.448875
NtUnmapViewOfSection
process_identifier: 2032
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619853213.511875
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2032
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853213.620875
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619853213.620875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2032
success 0 0
1619853214.308875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2032
success 0 0
1619853214.605875
CreateProcessInternalW
thread_identifier: 1888
thread_handle: 0x0000010c
process_identifier: 2116
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe" 2 2032 28898531
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619853217.292499
CreateProcessInternalW
thread_identifier: 3044
thread_handle: 0x00000120
process_identifier: 1476
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619853218.636499
CreateProcessInternalW
thread_identifier: 2128
thread_handle: 0x00000108
process_identifier: 324
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619853218.636499
NtUnmapViewOfSection
process_identifier: 324
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619853218.667499
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 324
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853218.980499
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619853218.980499
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 324
success 0 0
1619853219.464499
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 324
success 0 0
1619853219.605499
CreateProcessInternalW
thread_identifier: 1752
thread_handle: 0x0000010c
process_identifier: 880
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe" 2 324 28903703
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619853222.542125
CreateProcessInternalW
thread_identifier: 1208
thread_handle: 0x00000138
process_identifier: 2772
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000013c
inherit_handles: 0
success 1 0
1619853223.98
CreateProcessInternalW
thread_identifier: 2128
thread_handle: 0x00000108
process_identifier: 708
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619853223.98
NtUnmapViewOfSection
process_identifier: 708
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619853224.042
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 708
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853224.152
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619853224.152
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 708
success 0 0
1619853224.636
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 708
success 0 0
1619853224.777
CreateProcessInternalW
thread_identifier: 2448
thread_handle: 0x0000010c
process_identifier: 1688
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe" 2 708 28908859
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619853228.167
CreateProcessInternalW
thread_identifier: 3104
thread_handle: 0x0000013c
process_identifier: 3100
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
1619853229.777
CreateProcessInternalW
thread_identifier: 3192
thread_handle: 0x00000108
process_identifier: 3188
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619853229.777
NtUnmapViewOfSection
process_identifier: 3188
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619853229.792
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3188
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853229.902
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619853229.902
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3188
success 0 0
1619853230.292
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3188
success 0 0
1619853230.464
CreateProcessInternalW
thread_identifier: 3252
thread_handle: 0x0000010c
process_identifier: 3248
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe" 2 3188 28914515
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619853233.636875
CreateProcessInternalW
thread_identifier: 3356
thread_handle: 0x0000012c
process_identifier: 3352
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000130
inherit_handles: 0
success 1 0
1619853234.886374
CreateProcessInternalW
thread_identifier: 3532
thread_handle: 0x00000108
process_identifier: 3528
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\dyeuiwo.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619853234.886374
NtUnmapViewOfSection
process_identifier: 3528
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619853234.917374
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3528
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619853237.730374
NtGetContextThread
thread_handle: 0x00000108
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb BackDoor.SpyBotNET.25
MicroWorld-eScan Gen:Variant.Zusy.308923
FireEye Generic.mg.a6d7dab94fc0c160
McAfee Fareit-FVZ!A6D7DAB94FC0
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2257361
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
Arcabit Trojan.Zusy.D4B6BB
BitDefenderTheta Gen:NN.ZelphiF.34670.9GW@aO9mrkni
Cyren W32/Injector.BXXJ-4480
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.EMRT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Remcos-8987122-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Gen:Variant.Zusy.308923
NANO-Antivirus Trojan.Win32.Kryptik.hoacqx
AegisLab Trojan.Win32.Kryptik.4!c
Avast Win32:PWSX-gen [Trj]
Ad-Aware Gen:Variant.Zusy.308923
Sophos Mal/Generic-S
Comodo Malware@#2n8s8r98fvczm
F-Secure Trojan.TR/Injector.xogcy
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Gen:Variant.Zusy.308923 (B)
Jiangmin Trojan.Kryptik.bwy
Avira TR/Injector.xogcy
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Gen:Variant.Zusy.308923
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
VBA32 TScope.Trojan.Delf
ALYac Gen:Variant.Zusy.308923
MAX malware (ai score=80)
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.94576
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMAD1.hp
Rising Trojan.Injector!1.C99D (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d164 VirtualFree
• 0x47d168 VirtualAlloc
• 0x47d16c LocalFree
• 0x47d170 LocalAlloc
• 0x47d174 GetVersion
• 0x47d178 GetCurrentThreadId
• 0x47d184 VirtualQuery
• 0x47d188 WideCharToMultiByte
• 0x47d18c MultiByteToWideChar
• 0x47d190 lstrlenA
• 0x47d194 lstrcpynA
• 0x47d198 LoadLibraryExA
• 0x47d19c GetThreadLocale
• 0x47d1a0 GetStartupInfoA
• 0x47d1a4 GetProcAddress
• 0x47d1a8 GetModuleHandleA
• 0x47d1ac GetModuleFileNameA
• 0x47d1b0 GetLocaleInfoA
• 0x47d1b4 GetCommandLineA
• 0x47d1b8 FreeLibrary
• 0x47d1bc FindFirstFileA
• 0x47d1c0 FindClose
• 0x47d1c4 ExitProcess
• 0x47d1c8 WriteFile
• 0x47d1d0 RtlUnwind
• 0x47d1d4 RaiseException
• 0x47d1d8 GetStdHandle
Library user32.dll:
• 0x47d1e0 GetKeyboardType
• 0x47d1e4 LoadStringA
• 0x47d1e8 MessageBoxA
• 0x47d1ec CharNextA
Library advapi32.dll:
• 0x47d1f4 RegQueryValueExA
• 0x47d1f8 RegOpenKeyExA
• 0x47d1fc RegCloseKey
Library oleaut32.dll:
• 0x47d204 SysFreeString
• 0x47d208 SysReAllocStringLen
• 0x47d20c SysAllocStringLen
Library kernel32.dll:
• 0x47d214 TlsSetValue
• 0x47d218 TlsGetValue
• 0x47d21c LocalAlloc
• 0x47d220 GetModuleHandleA
Library advapi32.dll:
• 0x47d228 RegQueryValueExA
• 0x47d22c RegOpenKeyExA
• 0x47d230 RegCloseKey
Library kernel32.dll:
• 0x47d238 lstrcpyA
• 0x47d23c WriteFile
• 0x47d240 WaitForSingleObject
• 0x47d244 VirtualQuery
• 0x47d248 VirtualProtect
• 0x47d24c VirtualAlloc
• 0x47d250 Sleep
• 0x47d254 SizeofResource
• 0x47d258 SetThreadLocale
• 0x47d25c SetFilePointer
• 0x47d260 SetEvent
• 0x47d264 SetErrorMode
• 0x47d268 SetEndOfFile
• 0x47d26c ResetEvent
• 0x47d270 ReadFile
• 0x47d274 MultiByteToWideChar
• 0x47d278 MulDiv
• 0x47d27c LockResource
• 0x47d280 LoadResource
• 0x47d284 LoadLibraryA
• 0x47d290 GlobalUnlock
• 0x47d294 GlobalReAlloc
• 0x47d298 GlobalHandle
• 0x47d29c GlobalLock
• 0x47d2a0 GlobalFree
• 0x47d2a4 GlobalFindAtomA
• 0x47d2a8 GlobalDeleteAtom
• 0x47d2ac GlobalAlloc
• 0x47d2b0 GlobalAddAtomA
• 0x47d2b4 GetVersionExA
• 0x47d2b8 GetVersion
• 0x47d2bc GetTickCount
• 0x47d2c0 GetThreadLocale
• 0x47d2c4 GetSystemInfo
• 0x47d2c8 GetStringTypeExA
• 0x47d2cc GetStdHandle
• 0x47d2d0 GetProcAddress
• 0x47d2d4 GetModuleHandleA
• 0x47d2d8 GetModuleFileNameA
• 0x47d2dc GetLocaleInfoA
• 0x47d2e0 GetLocalTime
• 0x47d2e4 GetLastError
• 0x47d2e8 GetFullPathNameA
• 0x47d2ec GetFileAttributesA
• 0x47d2f0 GetDiskFreeSpaceA
• 0x47d2f4 GetDateFormatA
• 0x47d2f8 GetCurrentThreadId
• 0x47d2fc GetCurrentProcessId
• 0x47d300 GetCPInfo
• 0x47d304 GetACP
• 0x47d308 FreeResource
• 0x47d310 InterlockedExchange
• 0x47d318 FreeLibrary
• 0x47d31c FormatMessageA
• 0x47d320 FindResourceA
• 0x47d324 FindFirstFileA
• 0x47d328 FindClose
• 0x47d334 EnumCalendarInfoA
• 0x47d340 CreateThread
• 0x47d344 CreateFileA
• 0x47d348 CreateEventA
• 0x47d34c CompareStringA
• 0x47d350 CloseHandle
Library version.dll:
• 0x47d358 VerQueryValueA
• 0x47d360 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d368 UnrealizeObject
• 0x47d36c StretchBlt
• 0x47d370 SetWindowOrgEx
• 0x47d374 SetWinMetaFileBits
• 0x47d378 SetViewportOrgEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetEnhMetaFileBits
• 0x47d390 SetDIBColorTable
• 0x47d394 SetBrushOrgEx
• 0x47d398 SetBkMode
• 0x47d39c SetBkColor
• 0x47d3a0 SelectPalette
• 0x47d3a4 SelectObject
• 0x47d3a8 SaveDC
• 0x47d3ac RestoreDC
• 0x47d3b0 Rectangle
• 0x47d3b4 RectVisible
• 0x47d3b8 RealizePalette
• 0x47d3bc Polyline
• 0x47d3c0 PlayEnhMetaFile
• 0x47d3c4 PatBlt
• 0x47d3c8 MoveToEx
• 0x47d3cc MaskBlt
• 0x47d3d0 LineTo
• 0x47d3d4 IntersectClipRect
• 0x47d3d8 GetWindowOrgEx
• 0x47d3dc GetWinMetaFileBits
• 0x47d3e0 GetTextMetricsA
• 0x47d3ec GetStockObject
• 0x47d3f0 GetPixel
• 0x47d3f4 GetPaletteEntries
• 0x47d3f8 GetObjectA
• 0x47d404 GetEnhMetaFileBits
• 0x47d408 GetDeviceCaps
• 0x47d40c GetDIBits
• 0x47d410 GetDIBColorTable
• 0x47d414 GetDCOrgEx
• 0x47d41c GetClipBox
• 0x47d420 GetBrushOrgEx
• 0x47d424 GetBitmapBits
• 0x47d428 ExcludeClipRect
• 0x47d42c DeleteObject
• 0x47d430 DeleteEnhMetaFile
• 0x47d434 DeleteDC
• 0x47d438 CreateSolidBrush
• 0x47d43c CreatePenIndirect
• 0x47d440 CreatePalette
• 0x47d448 CreateFontIndirectA
• 0x47d44c CreateDIBitmap
• 0x47d450 CreateDIBSection
• 0x47d454 CreateCompatibleDC
• 0x47d45c CreateBrushIndirect
• 0x47d460 CreateBitmap
• 0x47d464 CopyEnhMetaFileA
• 0x47d468 BitBlt
Library user32.dll:
• 0x47d470 CreateWindowExA
• 0x47d474 WindowFromPoint
• 0x47d478 WinHelpA
• 0x47d47c WaitMessage
• 0x47d480 UpdateWindow
• 0x47d484 UnregisterClassA
• 0x47d488 UnhookWindowsHookEx
• 0x47d48c TranslateMessage
• 0x47d494 TrackPopupMenu
• 0x47d49c ShowWindow
• 0x47d4a0 ShowScrollBar
• 0x47d4a4 ShowOwnedPopups
• 0x47d4a8 ShowCursor
• 0x47d4ac SetWindowsHookExA
• 0x47d4b0 SetWindowPos
• 0x47d4b4 SetWindowPlacement
• 0x47d4b8 SetWindowLongA
• 0x47d4bc SetTimer
• 0x47d4c0 SetScrollRange
• 0x47d4c4 SetScrollPos
• 0x47d4c8 SetScrollInfo
• 0x47d4cc SetRect
• 0x47d4d0 SetPropA
• 0x47d4d4 SetParent
• 0x47d4d8 SetMenuItemInfoA
• 0x47d4dc SetMenu
• 0x47d4e0 SetForegroundWindow
• 0x47d4e4 SetFocus
• 0x47d4e8 SetCursor
• 0x47d4ec SetClassLongA
• 0x47d4f0 SetCapture
• 0x47d4f4 SetActiveWindow
• 0x47d4f8 SendMessageA
• 0x47d4fc ScrollWindow
• 0x47d500 ScreenToClient
• 0x47d504 RemovePropA
• 0x47d508 RemoveMenu
• 0x47d50c ReleaseDC
• 0x47d510 ReleaseCapture
• 0x47d51c RegisterClassA
• 0x47d520 RedrawWindow
• 0x47d524 PtInRect
• 0x47d528 PostQuitMessage
• 0x47d52c PostMessageA
• 0x47d530 PeekMessageA
• 0x47d534 OffsetRect
• 0x47d538 OemToCharA
• 0x47d53c MessageBoxA
• 0x47d540 MapWindowPoints
• 0x47d544 MapVirtualKeyA
• 0x47d548 LoadStringA
• 0x47d54c LoadKeyboardLayoutA
• 0x47d550 LoadIconA
• 0x47d554 LoadCursorA
• 0x47d558 LoadBitmapA
• 0x47d55c KillTimer
• 0x47d560 IsZoomed
• 0x47d564 IsWindowVisible
• 0x47d568 IsWindowEnabled
• 0x47d56c IsWindow
• 0x47d570 IsRectEmpty
• 0x47d574 IsIconic
• 0x47d578 IsDialogMessageA
• 0x47d57c IsChild
• 0x47d580 InvalidateRect
• 0x47d584 IntersectRect
• 0x47d588 InsertMenuItemA
• 0x47d58c InsertMenuA
• 0x47d590 InflateRect
• 0x47d598 GetWindowTextA
• 0x47d59c GetWindowRect
• 0x47d5a0 GetWindowPlacement
• 0x47d5a4 GetWindowLongA
• 0x47d5a8 GetWindowDC
• 0x47d5ac GetTopWindow
• 0x47d5b0 GetSystemMetrics
• 0x47d5b4 GetSystemMenu
• 0x47d5b8 GetSysColorBrush
• 0x47d5bc GetSysColor
• 0x47d5c0 GetSubMenu
• 0x47d5c4 GetScrollRange
• 0x47d5c8 GetScrollPos
• 0x47d5cc GetScrollInfo
• 0x47d5d0 GetPropA
• 0x47d5d4 GetParent
• 0x47d5d8 GetWindow
• 0x47d5dc GetMenuStringA
• 0x47d5e0 GetMenuState
• 0x47d5e4 GetMenuItemInfoA
• 0x47d5e8 GetMenuItemID
• 0x47d5ec GetMenuItemCount
• 0x47d5f0 GetMenu
• 0x47d5f4 GetLastActivePopup
• 0x47d5f8 GetKeyboardState
• 0x47d600 GetKeyboardLayout
• 0x47d604 GetKeyState
• 0x47d608 GetKeyNameTextA
• 0x47d60c GetIconInfo
• 0x47d610 GetForegroundWindow
• 0x47d614 GetFocus
• 0x47d618 GetDlgItem
• 0x47d61c GetDesktopWindow
• 0x47d620 GetDCEx
• 0x47d624 GetDC
• 0x47d628 GetCursorPos
• 0x47d62c GetCursor
• 0x47d630 GetClipboardData
• 0x47d634 GetClientRect
• 0x47d638 GetClassNameA
• 0x47d63c GetClassInfoA
• 0x47d640 GetCapture
• 0x47d644 GetActiveWindow
• 0x47d648 FrameRect
• 0x47d64c FindWindowA
• 0x47d650 FillRect
• 0x47d654 EqualRect
• 0x47d658 EnumWindows
• 0x47d65c EnumThreadWindows
• 0x47d660 EndPaint
• 0x47d664 EnableWindow
• 0x47d668 EnableScrollBar
• 0x47d66c EnableMenuItem
• 0x47d670 DrawTextA
• 0x47d674 DrawMenuBar
• 0x47d678 DrawIconEx
• 0x47d67c DrawIcon
• 0x47d680 DrawFrameControl
• 0x47d684 DrawEdge
• 0x47d688 DispatchMessageA
• 0x47d68c DestroyWindow
• 0x47d690 DestroyMenu
• 0x47d694 DestroyIcon
• 0x47d698 DestroyCursor
• 0x47d69c DeleteMenu
• 0x47d6a0 DefWindowProcA
• 0x47d6a4 DefMDIChildProcA
• 0x47d6a8 DefFrameProcA
• 0x47d6ac CreatePopupMenu
• 0x47d6b0 CreateMenu
• 0x47d6b4 CreateIcon
• 0x47d6b8 ClientToScreen
• 0x47d6bc CheckMenuItem
• 0x47d6c0 CallWindowProcA
• 0x47d6c4 CallNextHookEx
• 0x47d6c8 BeginPaint
• 0x47d6cc CharNextA
• 0x47d6d0 CharLowerBuffA
• 0x47d6d4 CharLowerA
• 0x47d6d8 CharToOemA
• 0x47d6dc AdjustWindowRectEx
Library kernel32.dll:
• 0x47d6e8 Sleep
Library oleaut32.dll:
• 0x47d6f0 SafeArrayPtrOfIndex
• 0x47d6f4 SafeArrayGetUBound
• 0x47d6f8 SafeArrayGetLBound
• 0x47d6fc SafeArrayCreate
• 0x47d700 VariantChangeType
• 0x47d704 VariantCopy
• 0x47d708 VariantClear
• 0x47d70c VariantInit
Library ole32.dll:
• 0x47d714 CoCreateInstance
• 0x47d718 CoUninitialize
• 0x47d71c CoInitialize
Library oleaut32.dll:
• 0x47d724 CreateErrorInfo
• 0x47d728 GetErrorInfo
• 0x47d72c SetErrorInfo
• 0x47d730 SysFreeString
Library comctl32.dll:
• 0x47d740 ImageList_Write
• 0x47d744 ImageList_Read
• 0x47d754 ImageList_DragMove
• 0x47d758 ImageList_DragLeave
• 0x47d75c ImageList_DragEnter
• 0x47d760 ImageList_EndDrag
• 0x47d764 ImageList_BeginDrag
• 0x47d768 ImageList_Remove
• 0x47d76c ImageList_DrawEx
• 0x47d770 ImageList_Replace
• 0x47d774 ImageList_Draw
• 0x47d784 ImageList_Add
• 0x47d78c ImageList_Destroy
• 0x47d790 ImageList_Create
Library comdlg32.dll:
• 0x47d798 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.