9.8
极危
46 个模型检测该样本为恶意！
重新分析
更多

2d9ada58c08fa88b3eafe4aff59cfb3fd0e136c0252da992de7ef73c669f24b3

ad43e3837fa9feeebfc3651a2e9b2bfe.exe

分析耗时

117s

最近分析

文件大小

1.6MB
静态报毒 动态报毒 AI SCORE=88 ALI2000016 ARTEMIS AVEMARIA CLOUD CONFIDENCE CRYPTINJECT ENRZ ENUT FALSESIGN GDSDA GENERICKD GENKRYPTIK JUEU KN1@AWWJKYNI KRYPT KRYPTIK LNXR MALICIOUS PE MORTYSTEALER RBWXN SCORE UNSAFE USXVPG720 ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!AD43E3837FA9 20200721 6.0.6.653
Alibaba Trojan:Win32/Kryptik.ali2000016 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200721 18.4.3895.0
Tencent Win32.Trojan.Falsesign.Lnxr 20200721 1.0.0.1
Kingsoft 20200721 2013.8.14.323
静态指标
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619826886.477307
IsDebuggerPresent
failed 0 0
1619826886.477307
IsDebuggerPresent
failed 0 0
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619826886.555307
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619859015.693374
__exception__
stacktrace: 
ad43e3837fa9feeebfc3651a2e9b2bfe+0x3556 @ 0x403556
ad43e3837fa9feeebfc3651a2e9b2bfe+0x111a0 @ 0x4111a0
ad43e3837fa9feeebfc3651a2e9b2bfe+0x13321 @ 0x413321
ad43e3837fa9feeebfc3651a2e9b2bfe+0x5abc @ 0x405abc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 2880096
registers.edi: 2880236
registers.eax: 2880120
registers.ebp: 2880136
registers.edx: 53018624
registers.ebx: 2880376
registers.esi: 2880392
registers.ecx: 0
exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7
exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118
exception.instruction: movzx eax, word ptr [ecx]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 209176
exception.address: 0x76373118
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (48 个事件)
Time & API Arguments Status Return Repeated
1619826885.852307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x004b0000
success 0 0
1619826885.852307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004d0000
success 0 0
1619826886.290307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00380000
success 0 0
1619826886.290307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00380000
success 0 0
1619826886.305307
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619826886.477307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00ab0000
success 0 0
1619826886.477307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b50000
success 0 0
1619826886.493307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004ca000
success 0 0
1619826886.493307
NtProtectVirtualMemory
process_identifier: 472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619826886.493307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004c2000
success 0 0
1619826886.821307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00512000
success 0 0
1619826886.915307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00535000
success 0 0
1619826886.915307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053b000
success 0 0
1619826886.915307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00537000
success 0 0
1619826887.040307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00513000
success 0 0
1619826887.071307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0051c000
success 0 0
1619826887.118307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ae0000
success 0 0
1619826887.587307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00514000
success 0 0
1619826887.774307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00515000
success 0 0
1619826887.774307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00516000
success 0 0
1619826888.274307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0a780000
success 0 0
1619826888.274307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 3510272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0a781000
success 0 0
1619826889.712307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00517000
success 0 0
1619826889.712307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00518000
success 0 0
1619826889.805307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00526000
success 0 0
1619826890.196307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619826890.196307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00527000
success 0 0
1619826890.430307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00519000
success 0 0
1619826890.430307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e50000
success 0 0
1619826890.493307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0aada000
success 0 0
1619826890.524307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e51000
success 0 0
1619826890.587307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0aadb000
success 0 0
1619826890.633307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e52000
success 0 0
1619826890.633307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0aadc000
success 0 0
1619826890.680307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0aadd000
success 0 0
1619826890.680307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004cc000
success 0 0
1619826890.680307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010d0000
success 0 0
1619826890.680307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010d1000
success 0 0
1619826890.696307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0051d000
success 0 0
1619826890.727307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010d4000
success 0 0
1619826890.774307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010d5000
success 0 0
1619826890.805307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010d9000
success 0 0
1619826890.805307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010dc000
success 0 0
1619826890.837307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e53000
success 0 0
1619826890.868307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004c3000
success 0 0
1619826890.883307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x010dd000
success 0 0
1619826891.352307
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00e54000
success 0 0
1619858651.759521
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000040e0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 20.185.199.35
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619826890.977307
NtAllocateVirtualMemory
process_identifier: 2420
region_size: 1421312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000224
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,ü=Z@@°@…wðL˜ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcL˜ðš€@@.relocˆ@B.bss *@@
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: Í@ï@þ@ @@+@:@\@k@€@™TÍ<¨‡K¢`ˆˆÝ;UBÄôKŠ› A³€ÝJpMÛ(P‘AP‘AU‹ì‹U‹E‹È…Òt ÆAƒêu÷]ÃU‹ìd¡0ƒì‹@ SVW‹x 駋G03ö‹_,‹?‰Eø‹B<‰}ô‹Dx‰Eð…À„…Áë3ɅÛt-‹}ø¾ÁÎ €<a‰Uø| ‹ÂƒÀàðëuøA;ËrߋUü‹}ô‹Eð‹L3ۋD ‰Mì…Ét<‹3ÿʃÀ‰Mø‹Ñ‰EèŠ ÁÏ ¾ÁøB„Éuñ‹Uü‰}ø‹Eø‹}ôÆ;Et ‹EèC;]ìrċW‰Uü…Ò…Kÿÿÿ3À_^[É‹uð‹D$X· ‹Dˆ‹ÂëÝU‹ìì¼‹ESVW‹XhLw&‰M ‰]¸èèþÿÿ‹ðÇEÄkern3ÀÇEÈel32ˆEЈEލEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿ֍EàPÿ֍EÔPÿÖhX¤SåèyþÿÿhyÌ?†‰EèlþÿÿhEƒV‰Eôè_þÿÿhDð5à‰EÀèRþÿÿhP‰E¤èEþÿÿhƖ‡R‰Eœè8þÿÿh_xTî‰Eðè+þÿÿhÚöÚO‰E˜èþÿÿ‹øhÆp‰}´èþÿÿh­ž_»‹ðèþÿÿh-W®[‰E¼èöýÿÿ‰E¬3ÀPh€jPPh€S‰E¨ÿ×j‰EìPÿ֋]‹ø‰}°jh0WjÿӋð…ötîjE¨PW‹}ìVWÿU¼WÿUð€>M‹]¸t jEøPPjÿUÀÆE hà.ÿU¤3À}ˆ«jDj«««…DÿÿÿPèTýÿÿƒÄ ÿu jhÿÿÿUœ‰E¼…ÀuOEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…À…¯PPjPPh@S‰E¸ÿU´‹øjƒÿÿtE¸ë^EüPPjÿUÀ鄃eìMìQPÿU˜}ìtoEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…ÀuOPPjPPh@S‰EÿU´‹øjƒÿÿt*EPÿu°VWÿU¬WÿUðEˆP…DÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆE ÿu¼ÿUð€} „åþÿÿ_^[ÉÃ,mAd
process_handle: 0x00000224
base_address: 0x00419000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: 2ºŒî¢Mcšã-¡Éø턐åW†Á‚ÇÒ5òú|¨GE;ð‘8C²µ!ü“5þE|H[r õr ç -aÓÚêr‰Cƒø«àÛ;hËû1t¿@ñªU1žatF_áS8=f»4'$Èä°´î |ÕýQ ÇÉN!}ˆ!üˆ
process_handle: 0x00000224
base_address: 0x0055a000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: @
process_handle: 0x00000224
base_address: 0xfffde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,ü=Z@@°@…wðL˜ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcL˜ðš€@@.relocˆ@B.bss *@@
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 472 called NtSetContextThread to modify thread in remote process 2420
Time & API Arguments Status Return Repeated
1619826890.977307
NtSetContextThread
thread_handle: 0x00000228
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4217405
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
process_identifier: 2420
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\:Zone.Identifier
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 472 resumed a thread in remote process 2420
Time & API Arguments Status Return Repeated
1619826891.352307
NtResumeThread
thread_handle: 0x00000228
suspend_count: 1
process_identifier: 2420
success 0 0
Executed a process and injected code into it, probably while unpacking (17 个事件)
Time & API Arguments Status Return Repeated
1619826886.477307
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 472
success 0 0
1619826886.508307
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 472
success 0 0
1619826886.555307
NtResumeThread
thread_handle: 0x00000164
suspend_count: 1
process_identifier: 472
success 0 0
1619826890.337307
NtResumeThread
thread_handle: 0x0000021c
suspend_count: 1
process_identifier: 472
success 0 0
1619826890.962307
CreateProcessInternalW
thread_identifier: 2900
thread_handle: 0x00000228
process_identifier: 2420
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ad43e3837fa9feeebfc3651a2e9b2bfe.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ad43e3837fa9feeebfc3651a2e9b2bfe.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000224
inherit_handles: 0
success 1 0
1619826890.977307
NtGetContextThread
thread_handle: 0x00000228
success 0 0
1619826890.977307
NtAllocateVirtualMemory
process_identifier: 2420
region_size: 1421312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000224
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,ü=Z@@°@…wðL˜ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcL˜ðš€@@.relocˆ@B.bss *@@
process_handle: 0x00000224
base_address: 0x00400000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer:
process_handle: 0x00000224
base_address: 0x00401000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer:
process_handle: 0x00000224
base_address: 0x00414000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: Í@ï@þ@ @@+@:@\@k@€@™TÍ<¨‡K¢`ˆˆÝ;UBÄôKŠ› A³€ÝJpMÛ(P‘AP‘AU‹ì‹U‹E‹È…Òt ÆAƒêu÷]ÃU‹ìd¡0ƒì‹@ SVW‹x 駋G03ö‹_,‹?‰Eø‹B<‰}ô‹Dx‰Eð…À„…Áë3ɅÛt-‹}ø¾ÁÎ €<a‰Uø| ‹ÂƒÀàðëuøA;ËrߋUü‹}ô‹Eð‹L3ۋD ‰Mì…Ét<‹3ÿʃÀ‰Mø‹Ñ‰EèŠ ÁÏ ¾ÁøB„Éuñ‹Uü‰}ø‹Eø‹}ôÆ;Et ‹EèC;]ìrċW‰Uü…Ò…Kÿÿÿ3À_^[É‹uð‹D$X· ‹Dˆ‹ÂëÝU‹ìì¼‹ESVW‹XhLw&‰M ‰]¸èèþÿÿ‹ðÇEÄkern3ÀÇEÈel32ˆEЈEލEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿ֍EàPÿ֍EÔPÿÖhX¤SåèyþÿÿhyÌ?†‰EèlþÿÿhEƒV‰Eôè_þÿÿhDð5à‰EÀèRþÿÿhP‰E¤èEþÿÿhƖ‡R‰Eœè8þÿÿh_xTî‰Eðè+þÿÿhÚöÚO‰E˜èþÿÿ‹øhÆp‰}´èþÿÿh­ž_»‹ðèþÿÿh-W®[‰E¼èöýÿÿ‰E¬3ÀPh€jPPh€S‰E¨ÿ×j‰EìPÿ֋]‹ø‰}°jh0WjÿӋð…ötîjE¨PW‹}ìVWÿU¼WÿUð€>M‹]¸t jEøPPjÿUÀÆE hà.ÿU¤3À}ˆ«jDj«««…DÿÿÿPèTýÿÿƒÄ ÿu jhÿÿÿUœ‰E¼…ÀuOEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…À…¯PPjPPh@S‰E¸ÿU´‹øjƒÿÿtE¸ë^EüPPjÿUÀ鄃eìMìQPÿU˜}ìtoEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…ÀuOPPjPPh@S‰EÿU´‹øjƒÿÿt*EPÿu°VWÿU¬WÿUðEˆP…DÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆE ÿu¼ÿUð€} „åþÿÿ_^[ÉÃ,mAd
process_handle: 0x00000224
base_address: 0x00419000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer:
process_handle: 0x00000224
base_address: 0x0054f000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer:
process_handle: 0x00000224
base_address: 0x00559000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: 2ºŒî¢Mcšã-¡Éø턐åW†Á‚ÇÒ5òú|¨GE;ð‘8C²µ!ü“5þE|H[r õr ç -aÓÚêr‰Cƒø«àÛ;hËû1t¿@ñªU1žatF_áS8=f»4'$Èä°´î |ÕýQ ÇÉN!}ˆ!üˆ
process_handle: 0x00000224
base_address: 0x0055a000
success 1 0
1619826890.977307
WriteProcessMemory
process_identifier: 2420
buffer: @
process_handle: 0x00000224
base_address: 0xfffde008
success 1 0
1619826890.977307
NtSetContextThread
thread_handle: 0x00000228
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4217405
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
process_identifier: 2420
success 0 0
1619826891.352307
NtResumeThread
thread_handle: 0x00000228
suspend_count: 1
process_identifier: 2420
success 0 0
File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)
MicroWorld-eScan Trojan.GenericKD.34130796
FireEye Generic.mg.ad43e3837fa9feee
Qihoo-360 Generic/Trojan.Spy.78a
McAfee Artemis!AD43E3837FA9
Cylance Unsafe
Zillya Trojan.AveMaria.Win32.619
Sangfor Malware
K7AntiVirus Trojan ( 0056a2b11 )
Alibaba Trojan:Win32/Kryptik.ali2000016
K7GW Trojan ( 0056a2b11 )
CrowdStrike win/malicious_confidence_60% (W)
Arcabit Trojan.Generic.D208CB6C
Invincea heuristic
APEX Malicious
Avast Win32:Trojan-gen
GData Trojan.GenericKD.34130796
Kaspersky HEUR:Trojan-Spy.MSIL.AveMaria.gen
BitDefender Trojan.GenericKD.34130796
Paloalto generic.ml
AegisLab Trojan.MSIL.AveMaria.l!c
Tencent Win32.Trojan.Falsesign.Lnxr
Ad-Aware Trojan.GenericKD.34130796
Emsisoft Trojan.GenericKD.34130796 (B)
F-Secure Trojan.TR/AD.MortyStealer.rbwxn
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.CRYPTINJECT.USXVPG720
Sophos Mal/Generic-S
SentinelOne DFI - Malicious PE
Cyren W32/Trojan.JUEU-0013
Webroot W32.Trojan.Gen
Avira TR/AD.MortyStealer.rbwxn
MAX malware (ai score=88)
Antiy-AVL Trojan[Spy]/MSIL.AveMaria
ZoneAlarm HEUR:Trojan-Spy.MSIL.AveMaria.gen
Microsoft Trojan:Win32/CryptInject
ALYac Trojan.PSW.AveMaria
Malwarebytes Spyware.AveMaria
ESET-NOD32 a variant of MSIL/GenKryptik.ENUT
TrendMicro-HouseCall TrojanSpy.Win32.CRYPTINJECT.USXVPG720
Rising Spyware.AveMaria!8.108C2 (CLOUD)
Ikarus Trojan.MSIL.Krypt
eGambit Unsafe.AI_Score_69%
Fortinet MSIL/GenKryptik.ENRZ!tr
BitDefenderTheta Gen:NN.ZemsilF.34136.Kn1@aWwjkyni
AVG Win32:Trojan-gen
Panda Trj/GdSda.A
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.27.142:443
dead_host 20.185.199.35:5800
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2075-03-05 02:20:36

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.