SmartHawk

14.6

0-day

52 个模型检测该样本为恶意！

重新分析

下载样本

2cfd617054359be1330e82e944dd01ec3021a20656084bb19e5c0925c8edc0cd

a8d165096149bed37620c51583c44289.exe

分析耗时

93s

最近分析

文件大小

269.5KB

静态报毒动态报毒 0NA103CI20 100% AI SCORE=99 ATTRIBUTE AUTO CASDET CONFIDENCE ELDORADO ENHJA FAREIT GDSDA GENERIC PWS GENERICKD HGECQI HIGH CONFIDENCE HIGHCONFIDENCE KEKMT KRYPT KRYPTIK LOKIBOT LUZIFER MALWARE@#3HH5EL7T2JOO7 OCCAMY PACKEDNET PASSWORDSTEALER PUTTY QM0@A4SRCQO S + TROJ SCORE STATIC AI SUSPICIOUS PE TROJANX TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic PWS.y	20201228	6.0.6.653
Alibaba	Trojan:MSIL/Kryptik.184f44bc	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201228	21.1.5827.0
Kingsoft		20201228	2017.9.26.565
Tencent	Win32.Trojan.Inject.Auto	20201228	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (7 个事件)

Time & API	Arguments	Status	Return
1619826890.075176 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619826892.731176 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619826892.731176 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619826894.059176 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619858590.87375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619858596.76475 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619858602.04575 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826886.528176 IsDebuggerPresent		failed	0	0
1619826886.528176 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826886.606176 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 93 个事件)

Time & API	Arguments	Status
1619826885.919176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00280000	success
1619826885.919176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00290000	success
1619826886.247176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x009c0000	success
1619826886.247176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success
1619826886.388176 NtProtectVirtualMemory	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619826886.528176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01fe0000	success
1619826886.528176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02140000	success
1619826886.544176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fa000	success
1619826886.544176 NtProtectVirtualMemory	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619826886.544176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f2000	success
1619826886.841176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00302000	success
1619826887.013176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008c5000	success
1619826887.028176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008cb000	success
1619826887.028176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008c7000	success
1619826887.122176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00303000	success
1619826887.169176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030c000	success
1619826887.591176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00304000	success
1619826887.591176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00306000	success
1619826887.700176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad0000	success
1619826887.825176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00307000	success
1619826887.903176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b6000	success
1619826888.153176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a91000	success
1619826888.372176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00308000	success
1619826888.513176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00309000	success
1619826888.544176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008ba000	success
1619826888.544176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b7000	success
1619826888.653176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b70000	success
1619826888.653176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b71000	success
1619826888.981176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f3000	success
1619826889.106176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b72000	success
1619826889.138176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad1000	success
1619826889.169176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b73000	success
1619826889.184176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b74000	success
1619826889.184176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0030d000	success
1619826889.200176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad2000	success
1619826889.294176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad3000	success
1619826889.325176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad4000	success
1619826889.325176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b75000	success
1619826889.325176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fc000	success
1619826889.325176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad5000	success
1619826889.356176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad8000	success
1619826889.372176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad9000	success
1619826889.388176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b76000	success
1619826889.388176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ada000	success
1619826889.434176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00add000	success
1619826889.466176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ade000	success
1619826889.466176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b40000	success
1619826889.466176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b41000	success
1619826889.497176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b77000	success
1619826889.497176 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04b46000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hetsm.exe.lnk

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hetsm.exe.lnk

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619858602.01475 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8d165096149bed37620c51583c44289.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8d165096149bed37620c51583c44289.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.772818032705282

section

{'size_of_data': '0x00042c00', 'virtual_address': '0x00002000', 'entropy': 7.772818032705282, 'name': '.text', 'virtual_size': '0x00042b84'}

description

A section with a high entropy has been found

entropy

0.9925650557620818

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826888.794176 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619858596.62375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: adb2a306695c8c28522ea20500179474efb19158
buffer	Buffer with sha1: 300d2394e6018fedc94ee750ab41423349ea8c64

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826894.231176 NtAllocateVirtualMemory	process_identifier: 3152 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000478 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Attempts to identify installed AV products by installation directory (2 个事件)

file	C:\Program Files\AVAST Software
file	C:\Program Files (x86)\AVAST Software

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hetsm.exe.lnk

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À process_handle: 0x00000478 base_address: 0x00400000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: TÍ<¨K¢`Ý;U process_handle: 0x00000478 base_address: 0x0041a000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: @ process_handle: 0x00000478 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À process_handle: 0x00000478 base_address: 0x00400000	success	1	0

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3060 called NtSetContextThread to modify thread in remote process 3152
1619826894.231176 NtSetContextThread	thread_handle: 0x00000474 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3152	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3060 resumed a thread in remote process 3152
1619826894.513176 NtResumeThread	thread_handle: 0x00000474 suspend_count: 1 process_identifier: 3152	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619826886.528176 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 3060	success	0
1619826886.559176 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 3060	success	0
1619826886.606176 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 3060	success	0
1619826889.684176 NtResumeThread	thread_handle: 0x00000250 suspend_count: 1 process_identifier: 3060	success	0
1619826889.872176 NtResumeThread	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 3060	success	0
1619826894.044176 NtResumeThread	thread_handle: 0x00000464 suspend_count: 1 process_identifier: 3060	success	0
1619826894.231176 CreateProcessInternalW	thread_identifier: 3156 thread_handle: 0x00000474 process_identifier: 3152 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8d165096149bed37620c51583c44289.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8d165096149bed37620c51583c44289.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8d165096149bed37620c51583c44289.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000478 inherit_handles: 0	success	1
1619826894.231176 NtGetContextThread	thread_handle: 0x00000474	success	0
1619826894.231176 NtAllocateVirtualMemory	process_identifier: 3152 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000478 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþ¬¬¬Ô¬K£K¬ ¬=2ó¬¬¬Ô¬¬Ç¬Ô¬=2÷ó¬=2È¬Rich¬PELlWà8¢Þ9P@ ÐdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x À process_handle: 0x00000478 base_address: 0x00400000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: process_handle: 0x00000478 base_address: 0x00401000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: process_handle: 0x00000478 base_address: 0x00415000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: TÍ<¨K¢`Ý;U process_handle: 0x00000478 base_address: 0x0041a000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: process_handle: 0x00000478 base_address: 0x004a0000	success	1
1619826894.231176 WriteProcessMemory	process_identifier: 3152 buffer: @ process_handle: 0x00000478 base_address: 0x7efde008	success	1
1619826894.231176 NtSetContextThread	thread_handle: 0x00000474 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3152	success	0
1619826894.513176 NtResumeThread	thread_handle: 0x00000474 suspend_count: 1 process_identifier: 3152	success	0
1619858589.57675 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3152	success	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.PasswordStealer.GenericKD.43036138
FireEye	Generic.mg.a8d165096149bed3
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
K7AntiVirus	Trojan ( 005629011 )
Alibaba	Trojan:MSIL/Kryptik.184f44bc
K7GW	Trojan ( 005629011 )
Cybereason	malicious.96149b
Arcabit	Trojan.PasswordStealer.Generic.D290ADEA
BitDefenderTheta	Gen:NN.ZemsilF.34700.qm0@a4srCQo
Cyren	W32/MSIL_Kryptik.AIF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.PasswordStealer.GenericKD.43036138
NANO-Antivirus	Trojan.Win32.Kryptik.hgecqi
Paloalto	generic.ml
AegisLab	Trojan.Win32.Generic.4!c
Ad-Aware	Trojan.PasswordStealer.GenericKD.43036138
Sophos	Mal/Generic-S + Troj/Fareit-KBC
Comodo	Malware@#3hh5el7t2joo7
F-Secure	Trojan.TR/Kryptik.kekmt
DrWeb	Trojan.PackedNET.244
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103CI20
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Trojan.PasswordStealer.GenericKD.43036138 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Generic.enhja
Avira	TR/Kryptik.kekmt
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Win32.Occamy
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.PasswordStealer.GenericKD.43036138
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.RL_Generic.C4047458
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.Agent.MSIL.Krypt
Malwarebytes	Spyware.LokiBot
ESET-NOD32	a variant of MSIL/Kryptik.VBT
TrendMicro-HouseCall	TROJ_FRS.0NA103CI20
Tencent	Win32.Trojan.Inject.Auto
Ikarus	Trojan-Spy.Luzifer
eGambit	Unsafe.AI_Score_94%
Fortinet	MSIL/Kryptik.VBT!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-03-17 15:12:33

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
didxbooks.com
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.