SmartHawk

9.4

极危

48 个模型检测该样本为恶意！

重新分析

下载样本

d177132fa7941febe11431bb8dd897e86464eaac755b8e693ceba29be0f90afa

ade15be58f8f6f951c4176523853362c.exe

分析耗时

105s

最近分析

文件大小

617.5KB

静态报毒动态报毒 AGENTTESLA AI SCORE=87 ALI2000008 ATTRIBUTE BASIC CONFIDENCE CSHARP ELDORADO FAREIT GDSDA HIGH CONFIDENCE HIGHCONFIDENCE HNZVWY KCLOUD KILLPROC2 KRYPTIK MALWARE@#339Q4S38ZTNBU MALWAREX MMW@AGFSBGCI NANOBOT NANOCORE ODAFB R357247 SCORE STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/csharp.ali2000008	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20201228	21.1.5827.0
Kingsoft	Win32.Troj.Undef.(kcloud)	20201228	2017.9.26.565
McAfee	Fareit-FVK!ADE15BE58F8F	20201228	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Checks if process is being debugged by a debugger (40 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826882.598436 IsDebuggerPresent		failed	0	0
1619826882.598436 IsDebuggerPresent		failed	0	0
1619840924.44075 IsDebuggerPresent		failed	0	0
1619840924.44075 IsDebuggerPresent		failed	0	0
1619840927.971375 IsDebuggerPresent		failed	0	0
1619840927.971375 IsDebuggerPresent		failed	0	0
1619840928.893625 IsDebuggerPresent		failed	0	0
1619840928.893625 IsDebuggerPresent		failed	0	0
1619840932.11325 IsDebuggerPresent		failed	0	0
1619840932.12825 IsDebuggerPresent		failed	0	0
1619840932.800125 IsDebuggerPresent		failed	0	0
1619840932.800125 IsDebuggerPresent		failed	0	0
1619840936.23825 IsDebuggerPresent		failed	0	0
1619840936.23825 IsDebuggerPresent		failed	0	0
1619840937.222 IsDebuggerPresent		failed	0	0
1619840937.222 IsDebuggerPresent		failed	0	0
1619840943.09675 IsDebuggerPresent		failed	0	0
1619840943.09675 IsDebuggerPresent		failed	0	0
1619840947.503125 IsDebuggerPresent		failed	0	0
1619840947.503125 IsDebuggerPresent		failed	0	0
1619840952.815625 IsDebuggerPresent		failed	0	0
1619840952.815625 IsDebuggerPresent		failed	0	0
1619840953.955625 IsDebuggerPresent		failed	0	0
1619840953.955625 IsDebuggerPresent		failed	0	0
1619840962.097125 IsDebuggerPresent		failed	0	0
1619840962.097125 IsDebuggerPresent		failed	0	0
1619840964.768875 IsDebuggerPresent		failed	0	0
1619840964.768875 IsDebuggerPresent		failed	0	0
1619840969.127625 IsDebuggerPresent		failed	0	0
1619840969.190625 IsDebuggerPresent		failed	0	0
1619840971.894125 IsDebuggerPresent		failed	0	0
1619840971.894125 IsDebuggerPresent		failed	0	0
1619840980.73825 IsDebuggerPresent		failed	0	0
1619840980.73825 IsDebuggerPresent		failed	0	0
1619840982.221625 IsDebuggerPresent		failed	0	0
1619840982.221625 IsDebuggerPresent		failed	0	0
1619840989.596375 IsDebuggerPresent		failed	0	0
1619840989.596375 IsDebuggerPresent		failed	0	0
1619840993.04975 IsDebuggerPresent		failed	0	0
1619840993.04975 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826882.645436 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 916 个事件)

Time & API	Arguments	Status
1619826881.723436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003c0000	success
1619826881.723436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00420000	success
1619826882.176436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00740000	success
1619826882.176436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f0000	success
1619826882.348436 NtProtectVirtualMemory	process_identifier: 472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619826882.598436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00570000	success
1619826882.598436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success
1619826882.598436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003da000	success
1619826882.598436 NtProtectVirtualMemory	process_identifier: 472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619826882.598436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d2000	success
1619826882.957436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1619826883.035436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success
1619826883.035436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040b000	success
1619826883.035436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success
1619826883.145436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e3000	success
1619826883.160436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success
1619826883.223436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00830000	success
1619826883.239436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f6000	success
1619826883.270436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1619826883.270436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success
1619826883.317436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e4000	success
1619826883.535436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e5000	success
1619826883.629436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00831000	success
1619826883.754436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00990000	success
1619826884.426436 NtAllocateVirtualMemory	process_identifier: 472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00832000	success
1619840924.39375 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75261000	success
1619840924.39375 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b60000	success
1619840924.39375 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c90000	success
1619840924.40875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619840924.40875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x751a1000	success
1619840924.40875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00cd0000	success
1619840924.40875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e60000	success
1619840924.40875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619840924.44075 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b60000	success
1619840924.44075 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c20000	success
1619840924.44075 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0074a000	success
1619840924.44075 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619840924.44075 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00742000	success
1619840924.47175 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00972000	success
1619840924.47175 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00995000	success
1619840924.47175 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0099b000	success
1619840924.47175 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00997000	success
1619840924.53375 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x755f1000	success
1619840924.53375 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00973000	success
1619840924.54975 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74511000	success
1619840924.95575 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00974000	success
1619840924.97175 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00976000	success
1619840925.06575 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0097c000	success
1619840925.08075 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00977000	success
1619840925.17475 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00978000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8249731141302785

section

{'size_of_data': '0x0008a000', 'virtual_address': '0x00002000', 'entropy': 7.8249731141302785, 'name': '.text', 'virtual_size': '0x00089fb4'}

description

A section with a high entropy has been found

entropy

0.8946515397082658

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (11 个事件)

Time & API	Arguments	Status	Return
1619826884.301436 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840928.25275 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840928.393375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840932.47225 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840936.86325 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840947.09675 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840953.377625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840964.269125 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840971.112625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840981.51925 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619840992.424375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Terminates another process (18 个事件)

Time & API	Arguments	Status
1619840928.596375 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	failed
1619840928.596375 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	success
1619840932.59725 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	failed
1619840932.59725 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000026c	success
1619840937.15925 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	failed
1619840937.17525 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000278	success
1619840947.84675 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000002a4	failed
1619840947.84675 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000002a4	success
1619840953.674625 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	failed
1619840953.674625 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	success
1619840964.300125 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000280	failed
1619840964.300125 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000280	success
1619840971.846625 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	failed
1619840971.846625 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	success
1619840982.28425 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	failed
1619840982.30025 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000270	success
1619840992.908375 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	failed
1619840992.908375 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x00000284	success

One or more of the buffers contains an embedded PE file (9 个事件)

buffer	Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer	Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer	Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer	Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer	Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251
buffer	Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	185.244.30.251
host	79.134.225.12

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619840928.72175 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

RegAsm.exe tried to sleep 2728435 seconds, actually delayed analysis time by 2728435 seconds

Installs itself for autorun at Windows startup (11 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service	reg_value	C:\Program Files (x86)\DSL Service\dslsvc.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RegAsm	reg_value	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ade15be58f8f6f951c4176523853362c.exe

Manipulates memory of a non-child process indicative of process injection (30 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3308 manipulating memory of non-child process 3372
Process injection	Process 3544 manipulating memory of non-child process 3604
Process injection	Process 3544 manipulating memory of non-child process 3640
Process injection	Process 3544 manipulating memory of non-child process 3676
Process injection	Process 3544 manipulating memory of non-child process 3744
Process injection	Process 3544 manipulating memory of non-child process 3792
Process injection	Process 3936 manipulating memory of non-child process 1888
Process injection	Process 3324 manipulating memory of non-child process 2308
Process injection	Process 3244 manipulating memory of non-child process 920
Process injection	Process 3244 manipulating memory of non-child process 3524
1619840936.73825 NtAllocateVirtualMemory	process_identifier: 3372 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840936.75325 NtAllocateVirtualMemory	process_identifier: 3372 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840944.12775 NtAllocateVirtualMemory	process_identifier: 3604 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840944.12775 NtAllocateVirtualMemory	process_identifier: 3604 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840944.45575 NtAllocateVirtualMemory	process_identifier: 3640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840944.47175 NtAllocateVirtualMemory	process_identifier: 3640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840944.97175 NtAllocateVirtualMemory	process_identifier: 3676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000244 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840944.97175 NtAllocateVirtualMemory	process_identifier: 3676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000244 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840945.33075 NtAllocateVirtualMemory	process_identifier: 3744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000250 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840945.34675 NtAllocateVirtualMemory	process_identifier: 3744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000250 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840946.23775 NtAllocateVirtualMemory	process_identifier: 3792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000025c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840946.23775 NtAllocateVirtualMemory	process_identifier: 3792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000025c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840953.205625 NtAllocateVirtualMemory	process_identifier: 1888 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000001cc allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840953.205625 NtAllocateVirtualMemory	process_identifier: 1888 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000001cc allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840963.472125 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000022c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840963.472125 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000022c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619840991.190375 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000e0000	success	0	0
1619840991.205375 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000f0000	success	0	0
1619840991.627375 NtAllocateVirtualMemory	process_identifier: 3524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000023c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619840991.658375 NtAllocateVirtualMemory	process_identifier: 3524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x0000023c allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.3.Gen
FireEye	Generic.mg.ade15be58f8f6f95
ALYac	Trojan.MSIL.Basic.3.Gen
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056081c1 )
Alibaba	Trojan:Win32/csharp.ali2000008
K7GW	Trojan ( 0056081c1 )
Cybereason	malicious.58f8f6
Arcabit	Trojan.MSIL.Basic.3.Gen
Cyren	W32/MSIL_Kryptik.XL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.NanoBot.gen
BitDefender	Trojan.MSIL.Basic.3.Gen
NANO-Antivirus	Trojan.Win32.NanoBot.hnzvwy
AegisLab	Trojan.MSIL.NanoBot.4!c
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.MSIL.Basic.3.Gen
Sophos	Mal/Generic-S
Comodo	Malware@#339q4s38ztnbu
F-Secure	Trojan.TR/AD.Nanocore.odafb
DrWeb	Trojan.KillProc2.11367
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Emsisoft	Trojan.MSIL.Basic.3.Gen (B)
Ikarus	Trojan.Inject
Avira	TR/AD.Nanocore.odafb
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
ZoneAlarm	HEUR:Trojan.MSIL.NanoBot.gen
GData	Trojan.MSIL.Basic.3.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R357247
McAfee	Fareit-FVK!ADE15BE58F8F
VBA32	TScope.Trojan.MSIL
Malwarebytes	Backdoor.NanoCore
ESET-NOD32	a variant of MSIL/Kryptik.WOX
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.73688781.susgen
Fortinet	MSIL/Kryptik.WOU!tr
BitDefenderTheta	Gen:NN.ZemsilF.34700.MmW@aGFSbgci
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Generic/Trojan.BO.573

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (14 个事件)

dead_host	192.168.56.101:49180
dead_host	192.168.56.101:49212
dead_host	192.168.56.101:49203
dead_host	192.168.56.101:49192
dead_host	79.134.225.12:5600
dead_host	192.168.56.101:49218
dead_host	185.244.30.251:5600
dead_host	192.168.56.101:49196
dead_host	192.168.56.101:49177
dead_host	192.168.56.101:49206
dead_host	192.168.56.101:49208
dead_host	192.168.56.101:49186
dead_host	192.168.56.101:49183
dead_host	192.168.56.101:49214

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-16 18:54:40

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.