14.2
0-day
42 个模型检测该样本为恶意！
重新分析
更多

251c55b7c7c02eec9a87eca94bb01f653317ef5d8278aeb2b511194d7057a675

b2c133c86d118efc1545951cd95ea295.exe

分析耗时

91s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AGENSLA AI SCORE=88 AIDETECTVM ALI1000123 AUTOIT CONFIDENCE FORMBOOK FSNT GENERICKD HIGH CONFIDENCE HQGRGV MALITRAR MALWARE2 MALWARE@#1573EOTWQBWNJ ODRX PFSR PROBABLY HEUR QQPASS QQROB R + MAL R007C0PK820 R343019 RARAUTORUN RUNNER SCORE SUSPICIOUSTROJAN UBOPF UNSAFE YMACCO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Trojan-FSNT!B2C133C86D11 20201211 6.0.6.653
Alibaba Trojan:Win32/runner.ali1000123 20190527 0.3.0.5
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Tencent Msil.Trojan-qqpass.Qqrob.Pfsr 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_70% (W) 20190702 1.0
静态指标
Queries for the computername (4 个事件)
Time & API Arguments Status Return Repeated
1619887019.89675
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619887022.42775
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619887024.38075
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619887024.70875
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619886991.959
IsDebuggerPresent
failed 0 0
1619886991.975
IsDebuggerPresent
failed 0 0
1619887006.34975
IsDebuggerPresent
failed 0 0
1619887006.34975
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619886992.069
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .gfids
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name PNG
One or more processes crashed (8 个事件)
Time & API Arguments Status Return Repeated
1619887005.053
__exception__
stacktrace: 
RtlFreeHeap+0x7e RtlAllocateHeap-0x23 ntdll+0x2e003 @ 0x77d5e003
GlobalFree+0x27 GlobalAlloc-0x11f kernelbase+0x13e88 @ 0x778f3e88
dfnvol+0x10ccd @ 0xcf0ccd
dfnvol+0x7536e @ 0xd5536e
dfnvol+0x7557a @ 0xd5557a
dfnvol+0x3fa6 @ 0xce3fa6
dfnvol+0x8f8d @ 0xce8f8d
dfnvol+0x96f5 @ 0xce96f5
dfnvol+0xa2f7 @ 0xcea2f7
dfnvol+0x962c @ 0xce962c
dfnvol+0xa2f7 @ 0xcea2f7
dfnvol+0x962c @ 0xce962c
dfnvol+0xa2f7 @ 0xcea2f7
dfnvol+0x962c @ 0xce962c
dfnvol+0xa2f7 @ 0xcea2f7
dfnvol+0x962c @ 0xce962c
dfnvol+0xd87e @ 0xced87e
dfnvol+0xd967 @ 0xced967
dfnvol+0x1648e @ 0xcf648e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 7400072
registers.edi: 3498704896
registers.eax: 0
registers.ebp: 7400124
registers.edx: 0
registers.ebx: 3498704897
registers.esi: 15184576
registers.ecx: 29
exception.instruction_r: 89 30 8b 45 e0 8b 55 e4 8d 7e 08 f0 0f c7 0f 3b
exception.symbol: RtlInitUnicodeString+0x1f3 RtlMultiByteToUnicodeN-0x14a ntdll+0x2e3fb
exception.instruction: mov dword ptr [eax], esi
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 189435
exception.address: 0x77d5e3fb
success 0 0
1619887024.22475
__exception__
stacktrace: 
0x12ae775
0x12adbef
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3666244
registers.edi: 43137032
registers.eax: 0
registers.ebp: 3666288
registers.edx: 8
registers.ebx: 2040577846
registers.esi: 462241294
registers.ecx: 0
exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 dc 69 c6 64 05 b1 d5
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2791f7b
success 0 0
1619887046.67775
__exception__
stacktrace: 
0x5f60dae
0x12ae30d
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3664964
registers.edi: 3665004
registers.eax: 3
registers.ebp: 3665020
registers.edx: 0
registers.ebx: 43349056
registers.esi: 43689524
registers.ecx: 0
exception.instruction_r: 8b 01 8b 40 2c ff 50 14 39 00 89 45 c8 b8 95 42
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5dc24a5
success 0 0
1619887047.31875
__exception__
stacktrace: 
0x12ae30d
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3665028
registers.edi: 43724428
registers.eax: 0
registers.ebp: 3666336
registers.edx: 10
registers.ebx: 0
registers.esi: 1922311500
registers.ecx: 11
exception.instruction_r: 83 78 04 01 0f 9f c0 0f b6 c0 8b 95 08 fb ff ff
exception.instruction: cmp dword ptr [eax + 4], 1
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5f611b3
success 0 0
1619887049.06875
__exception__
stacktrace: 
0x5f6193a
0x12ae30d
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3664956
registers.edi: 44065788
registers.eax: 44068164
registers.ebp: 3665020
registers.edx: 44068164
registers.ebx: 44063748
registers.esi: 0
registers.ecx: 1908490458
exception.instruction_r: 39 06 68 ff ff ff 7f 6a 00 8b ce e8 f3 e9 0f 6c
exception.instruction: cmp dword ptr [esi], eax
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5dc9e7d
success 0 0
1619887049.42775
__exception__
stacktrace: 
0x5f61bda
0x12ae30d
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3664940
registers.edi: 3665004
registers.eax: 0
registers.ebp: 3665020
registers.edx: 42917668
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 39 09 e8 16 dd 01 6c 89 45 b4 b8 62 17 67 87 35
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5dce727
success 0 0
1619887049.45875
__exception__
stacktrace: 
0x5f61ccd
0x12ae30d
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3664904
registers.edi: 0
registers.eax: 63570587
registers.ebp: 3665020
registers.edx: 10
registers.ebx: 0
registers.esi: 1652835272
registers.ecx: 0
exception.instruction_r: 39 09 e8 e6 cf 01 6c 83 78 04 00 0f 84 97 03 00
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x5dcf457
success 0 0
1619887056.53675
__exception__
stacktrace: 
_vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x77da9e31
IsBadReadPtr+0xcc CreateSemaphoreA-0x31 kernel32+0x3d141 @ 0x7637d141
OleCreateFromData+0x195 NdrProxyForwardingFunction4-0x81f ole32+0xc586d @ 0x767b586d
ObjectStublessClient31+0x886b STGMEDIUM_UserUnmarshal-0x20e43 ole32+0x998db @ 0x767898db
system+0x577bfc @ 0x718e7bfc
system+0x7a0f66 @ 0x70ea0f66
system+0x7a092c @ 0x70ea092c
system+0x7a058e @ 0x70ea058e
system+0x79e700 @ 0x70e9e700
system+0x79d843 @ 0x70e9d843
system+0x79d8b1 @ 0x70e9d8b1
0x5f00e07
0x12ad60d
system+0x216fb6 @ 0x70916fb6
0x104116d
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x775a6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
0x5f00d17
0x12ae364
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73de21db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e04a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e04bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e04c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e04c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73ecce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73eccf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73eccda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73ecd199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73ecd09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73f4af00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750155ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x753e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x753e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3665012
registers.edi: 12910592
registers.eax: 4294967288
registers.ebp: 3665056
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 12910592
exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84
exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58
exception.instruction: cmp byte ptr [eax + 7], 5
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 499288
exception.address: 0x77da9e58
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 123 个事件)
Time & API Arguments Status Return Repeated
1619887005.95875
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00850000
success 0 0
1619887005.95875
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008a0000
success 0 0
1619887006.17775
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00f80000
success 0 0
1619887006.17775
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01040000
success 0 0
1619887006.25575
NtProtectVirtualMemory
process_identifier: 3372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73de1000
success 0 0
1619887006.34975
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01150000
success 0 0
1619887006.34975
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x011f0000
success 0 0
1619887006.36475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088a000
success 0 0
1619887006.36475
NtProtectVirtualMemory
process_identifier: 3372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73de2000
success 0 0
1619887006.36475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00882000
success 0 0
1619887006.66175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00892000
success 0 0
1619887006.77175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f5000
success 0 0
1619887006.77175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008fb000
success 0 0
1619887006.77175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008f7000
success 0 0
1619887006.89675
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00893000
success 0 0
1619887006.97475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00894000
success 0 0
1619887006.97475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0089c000
success 0 0
1619887007.08375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x012a0000
success 0 0
1619887007.08375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x012a1000
success 0 0
1619887007.30275
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00897000
success 0 0
1619887007.59975
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00898000
success 0 0
1619887007.69375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x012ad000
success 0 0
1619887007.75575
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e6000
success 0 0
1619887007.91175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01041000
success 0 0
1619887008.02175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008ea000
success 0 0
1619887008.02175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e7000
success 0 0
1619887008.22475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f10000
success 0 0
1619887008.22475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f11000
success 0 0
1619887008.27175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f12000
success 0 0
1619887008.30275
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x012ae000
success 0 0
1619887019.50575
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f13000
success 0 0
1619887020.67775
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x012af000
success 0 0
1619887020.70875
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f14000
success 0 0
1619887021.28675
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f15000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f16000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0089d000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02780000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02781000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0089a000
success 0 0
1619887021.38075
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0089b000
success 0 0
1619887021.41175
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02790000
success 0 0
1619887021.44375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f17000
success 0 0
1619887021.47475
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02791000
success 0 0
1619887021.81875
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f18000
success 0 0
1619887021.81875
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f19000
success 0 0
1619887021.83375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02792000
success 0 0
1619887021.83375
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f1a000
success 0 0
1619887021.84975
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00f1b000
success 0 0
1619887021.92775
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef30000
success 0 0
1619887021.92775
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
Steals private information from local Internet browsers (6 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data
Creates (office) documents on the filesystem (6 个事件)
file C:\Users\Administrator.Oskar-PC\temp\lron.ppt
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\hmtjntfoo.ppt
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\ptwbwxhoo.xls
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\ucebfhcgfn.ppt
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\lron.ppt
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\bifnhai.ppt
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\hrgvlfki.dll
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619887019.36475
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Expresses interest in specific running processes (1 个事件)
process regsvcs.exe
网络通信
One or more of the buffers contains an embedded PE file (2 个事件)
buffer Buffer with sha1: 39caa5297b690d2d9481026fc01e25287b100527
buffer Buffer with sha1: 8d3c4dd96dad6b312eff42473aee19807b414efb
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619887005.053
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 5029888
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000019c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00380000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description RegSvcs.exe tried to sleep 2728248 seconds, actually delayed analysis time by 2728248 seconds
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe reg_value C:\Users\ADMINI~1.OSK\AppData\Roaming\08501405\dfnvol.pif C:\Users\ADMINI~1.OSK\AppData\Roaming\08501405\vvqo.mpo
Harvests credentials from local FTP client softwares (4 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Potential code injection by writing to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619887005.162
WriteProcessMemory
process_identifier: 3372
buffer: ÿÿÿÿ8ú~ú~(ý~€›mèÿÿ jHâý~±
process_handle: 0x0000019c
base_address: 0x7efde000
success 1 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1619887056.55275
SetWindowsHookExW
thread_identifier: 0
callback_function: 0x01057682
module_address: 0x00380000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 590245 0
Harvests credentials from local email clients (5 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3240 called NtSetContextThread to modify thread in remote process 3372
Time & API Arguments Status Return Repeated
1619887005.162
NtSetContextThread
thread_handle: 0x00000198
registers.eip: 2010382788
registers.esp: 3669512
registers.edi: 0
registers.eax: 3962254
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3372
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3240 resumed a thread in remote process 3372
Time & API Arguments Status Return Repeated
1619887005.678
NtResumeThread
thread_handle: 0x00000198
suspend_count: 1
process_identifier: 3372
success 0 0
Executed a process and injected code into it, probably while unpacking (17 个事件)
Time & API Arguments Status Return Repeated
1619861125.790822
CreateProcessInternalW
thread_identifier: 3244
thread_handle: 0x00000268
process_identifier: 3240
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif" vvqo.mpo
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\08501405\dfnvol.pif
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000280
inherit_handles: 0
success 1 0
1619887003.49
NtResumeThread
thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 3240
success 0 0
1619887005.037
CreateProcessInternalW
thread_identifier: 3376
thread_handle: 0x00000198
process_identifier: 3372
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RegSvcs.exe
track: 1
command_line:
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\RegSvcs.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000019c
inherit_handles: 0
success 1 0
1619887005.053
NtGetContextThread
thread_handle: 0x00000198
success 0 0
1619887005.053
NtAllocateVirtualMemory
process_identifier: 3372
region_size: 5029888
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000019c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00380000
success 0 0
1619887005.084
WriteProcessMemory
process_identifier: 3372
buffer:
process_handle: 0x0000019c
base_address: 0x00380000
success 1 0
1619887005.162
WriteProcessMemory
process_identifier: 3372
buffer: ÿÿÿÿ8ú~ú~(ý~€›mèÿÿ jHâý~±
process_handle: 0x0000019c
base_address: 0x7efde000
success 1 0
1619887005.162
NtSetContextThread
thread_handle: 0x00000198
registers.eip: 2010382788
registers.esp: 3669512
registers.edi: 0
registers.eax: 3962254
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3372
success 0 0
1619887005.678
NtResumeThread
thread_handle: 0x00000198
suspend_count: 1
process_identifier: 3372
success 0 0
1619887006.34975
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 3372
success 0 0
1619887006.36475
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3372
success 0 0
1619887006.41175
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 3372
success 0 0
1619887021.89675
NtResumeThread
thread_handle: 0x000002e8
suspend_count: 1
process_identifier: 3372
success 0 0
1619887022.11475
NtResumeThread
thread_handle: 0x00000318
suspend_count: 1
process_identifier: 3372
success 0 0
1619887024.36475
NtResumeThread
thread_handle: 0x00000370
suspend_count: 1
process_identifier: 3372
success 0 0
1619887057.72475
NtResumeThread
thread_handle: 0x0000031c
suspend_count: 1
process_identifier: 3372
success 0 0
1619887057.81875
NtResumeThread
thread_handle: 0x00000428
suspend_count: 1
process_identifier: 3372
success 0 0
File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43649473
McAfee Trojan-FSNT!B2C133C86D11
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
K7AntiVirus Trojan ( 0057213c1 )
BitDefender Trojan.GenericKD.43649473
K7GW Trojan ( 0057213c1 )
Cybereason malicious.89d1da
Cyren W32/Trojan.ODRX-0142
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Autoit-7599063-0
Kaspersky Trojan-PSW.MSIL.Agensla.sht
Alibaba Trojan:Win32/runner.ali1000123
NANO-Antivirus Trojan.Win32.Agensla.hqgrgv
Avast Win32:Trojan-gen
Ad-Aware Trojan.GenericKD.43649473
Sophos Mal/Generic-R + Mal/MalitRar-I
Comodo Malware@#1573eotwqbwnj
TrendMicro TROJ_GEN.R007C0PK820
McAfee-GW-Edition BehavesLike.Win32.Suspicioustrojan.tc
Ikarus Trojan-Spy.FormBook
Avira TR/Agent.ubopf
MAX malware (ai score=88)
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Generic.D29A09C1
ZoneAlarm Trojan-PSW.MSIL.Agensla.sht
Microsoft Trojan:Win32/Ymacco.AA25
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R343019
VBA32 Trojan.Ymacco
Malwarebytes Trojan.Dropper.SFX
Zoner Probably Heur.RARAutorun
ESET-NOD32 RAR/Agent.DG
TrendMicro-HouseCall TROJ_GEN.R007C0PK820
Tencent Msil.Trojan-qqpass.Qqrob.Pfsr
AVG Win32:Trojan-gen
CrowdStrike win/malicious_confidence_70% (W)
Qihoo-360 Generic/Trojan.PSW.15e
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-04-28 04:03:27

Imports

Library KERNEL32.dll:
• 0x430000 GetLastError
• 0x430004 SetLastError
• 0x430008 GetCurrentProcess
• 0x43000c DeviceIoControl
• 0x430010 SetFileTime
• 0x430014 CloseHandle
• 0x430018 CreateDirectoryW
• 0x43001c RemoveDirectoryW
• 0x430020 CreateFileW
• 0x430024 DeleteFileW
• 0x430028 CreateHardLinkW
• 0x43002c GetShortPathNameW
• 0x430030 GetLongPathNameW
• 0x430034 MoveFileW
• 0x430038 GetFileType
• 0x43003c GetStdHandle
• 0x430040 WriteFile
• 0x430044 ReadFile
• 0x430048 FlushFileBuffers
• 0x43004c SetEndOfFile
• 0x430050 SetFilePointer
• 0x430054 SetFileAttributesW
• 0x430058 GetFileAttributesW
• 0x43005c FindClose
• 0x430060 FindFirstFileW
• 0x430064 FindNextFileW
• 0x430068 GetVersionExW
• 0x430070 GetFullPathNameW
• 0x430074 FoldStringW
• 0x430078 GetModuleFileNameW
• 0x43007c GetModuleHandleW
• 0x430080 FindResourceW
• 0x430084 FreeLibrary
• 0x430088 GetProcAddress
• 0x43008c GetCurrentProcessId
• 0x430090 ExitProcess
• 0x430098 Sleep
• 0x43009c LoadLibraryW
• 0x4300a0 GetSystemDirectoryW
• 0x4300a4 CompareStringW
• 0x4300a8 AllocConsole
• 0x4300ac FreeConsole
• 0x4300b0 AttachConsole
• 0x4300b4 WriteConsoleW
• 0x4300bc CreateThread
• 0x4300c0 SetThreadPriority
• 0x4300d4 SetEvent
• 0x4300d8 ResetEvent
• 0x4300dc ReleaseSemaphore
• 0x4300e0 WaitForSingleObject
• 0x4300e4 CreateEventW
• 0x4300e8 CreateSemaphoreW
• 0x4300ec GetSystemTime
• 0x430108 GetCPInfo
• 0x43010c IsDBCSLeadByte
• 0x430110 MultiByteToWideChar
• 0x430114 WideCharToMultiByte
• 0x430118 GlobalAlloc
• 0x43011c GetTickCount
• 0x430120 LockResource
• 0x430124 GlobalLock
• 0x430128 GlobalUnlock
• 0x43012c GlobalFree
• 0x430130 LoadResource
• 0x430134 SizeofResource
• 0x43013c GetExitCodeProcess
• 0x430140 GetLocalTime
• 0x430144 MapViewOfFile
• 0x430148 UnmapViewOfFile
• 0x43014c CreateFileMappingW
• 0x430150 OpenFileMappingW
• 0x430154 GetCommandLineW
• 0x430160 GetTempPathW
• 0x430164 MoveFileExW
• 0x430168 GetLocaleInfoW
• 0x43016c GetTimeFormatW
• 0x430170 GetDateFormatW
• 0x430174 GetNumberFormatW
• 0x430178 SetFilePointerEx
• 0x43017c GetConsoleMode
• 0x430180 GetConsoleCP
• 0x430184 HeapSize
• 0x430188 SetStdHandle
• 0x43018c GetProcessHeap
• 0x430190 RaiseException
• 0x430194 GetSystemInfo
• 0x430198 VirtualProtect
• 0x43019c VirtualQuery
• 0x4301a0 LoadLibraryExA
• 0x4301a8 IsDebuggerPresent
• 0x4301b4 GetStartupInfoW
• 0x4301bc GetCurrentThreadId
• 0x4301c4 InitializeSListHead
• 0x4301c8 TerminateProcess
• 0x4301cc RtlUnwind
• 0x4301d0 EncodePointer
• 0x4301d8 TlsAlloc
• 0x4301dc TlsGetValue
• 0x4301e0 TlsSetValue
• 0x4301e4 TlsFree
• 0x4301e8 LoadLibraryExW
• 0x4301f0 GetModuleHandleExW
• 0x4301f4 GetModuleFileNameA
• 0x4301f8 GetACP
• 0x4301fc HeapFree
• 0x430200 HeapAlloc
• 0x430204 HeapReAlloc
• 0x430208 GetStringTypeW
• 0x43020c LCMapStringW
• 0x430210 FindFirstFileExA
• 0x430214 FindNextFileA
• 0x430218 IsValidCodePage
• 0x43021c GetOEMCP
• 0x430220 GetCommandLineA
• 0x43022c DecodePointer
Library gdiplus.dll:
• 0x430234 GdiplusShutdown
• 0x430238 GdiplusStartup
• 0x430248 GdipDisposeImage
• 0x43024c GdipCloneImage
• 0x430250 GdipFree
• 0x430254 GdipAlloc

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.