SmartHawk

9.0

极危

50 个模型检测该样本为恶意！

重新分析

下载样本

280cd2300315b3e19e84909ff4346f66fb8ab5bc522b1cdee8ad1df438c53f00

bf4770b87a6c7728d1ef8dcbef304e24.exe

分析耗时

77s

最近分析

文件大小

920.5KB

静态报毒动态报毒 100% 5Y0@AYHLPBOI AIDETECTVM ARTEMIS ATTRIBUTE CLOUD CONFIDENCE EIQI ELDORADO GANDCRAB GENERICKD GGDKZK GVSM HIGH CONFIDENCE HIGHCONFIDENCE HPURSNIF KRYPTIK MALPE34 MALWARECRYPTER PHQD QQPASS QQROB QVM10 RACEALER RDQMJ SCORE SMZD2 SUSGEN SUSPICIOUS PE TIGGRE TROJANPSW TSPY UNSAFE X2029 ZEXAF ZPEVDO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	TrojanPSW:Win32/Racealer.2fe6dab9	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200427	18.4.3895.0
Kingsoft		20200428	2013.8.14.323
McAfee	Artemis!BF4770B87A6C	20200428	6.0.6.653
Tencent	Win32.Trojan-qqpass.Qqrob.Phqd	20200428	1.0.0.1

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619889639.098501 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619889673.490124 IsDebuggerPresent		failed	0	0

The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)

resource name	BINARY
resource name	PNG
resource name	RCDATA

One or more processes crashed (50 out of 5772 个事件)

Time & API	Arguments	Status
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7339 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7340 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7341 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7346 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7349 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7351 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7352 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7353 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7355 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7356 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7357 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7360 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7361 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7362 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7366 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7371 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7372 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7373 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7374 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7375 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7376 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7377 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.160501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7383 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7384 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7386 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 1 registers.ecx: 7387 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success
1619889639.176501 __exception__	stacktrace: registers.esp: 1635372 registers.edi: 0 registers.eax: 0 registers.ebp: 1635608 registers.edx: 4003138204 registers.ebx: 0 registers.esi: 4003104078 registers.ecx: 0 exception.instruction_r: 89 10 9b c7 45 fc fe ff ff ff eb 43 8b 4d ec 8b exception.symbol: bf4770b87a6c7728d1ef8dcbef304e24+0x10cb8 exception.instruction: mov dword ptr [eax], edx exception.module: bf4770b87a6c7728d1ef8dcbef304e24.exe exception.exception_code: 0xc0000005 exception.offset: 68792 exception.address: 0x410cb8	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 64 个事件)

Time & API	Arguments	Status
1619889639.145501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x07380000	success
1619889650.895501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889650.926501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889650.957501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889650.973501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889650.989501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.004501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.035501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.051501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.067501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.082501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.114501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.129501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.145501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.160501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.192501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.207501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.223501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09e20000	success
1619889651.254501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.285501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.301501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.317501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.332501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.364501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.379501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.395501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.410501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.426501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.457501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.473501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.489501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.504501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.535501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.551501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.567501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.582501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.614501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.629501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.645501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.660501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.692501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.707501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.723501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.739501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.754501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.785501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.801501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.817501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.832501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success
1619889651.864501 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x09f20000	success

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.908875189892547

section

{'size_of_data': '0x000a0400', 'virtual_address': '0x0004a000', 'entropy': 7.908875189892547, 'name': '.rsrc', 'virtual_size': '0x000a03d4'}

description

A section with a high entropy has been found

entropy

0.6971179989124524

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619889626.254501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: b7c6667e6b942f621e48c2340a1078bc228c7017

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.41.98

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1320 called NtSetContextThread to modify thread in remote process 1300
1619889652.176501 NtSetContextThread	thread_handle: 0x000001c0 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4394045 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1300	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1320 resumed a thread in remote process 1300
1619889652.239501 NtResumeThread	thread_handle: 0x000001c0 suspend_count: 1 process_identifier: 1300	success	0	0

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619889652.176501 CreateProcessInternalW	thread_identifier: 2448 thread_handle: 0x000001c0 process_identifier: 1300 current_directory: filepath: track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bf4770b87a6c7728d1ef8dcbef304e24.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000001c4 inherit_handles: 0	success	1
1619889652.176501 NtGetContextThread	thread_handle: 0x000001c0	success	0
1619889652.176501 WriteProcessMemory	process_identifier: 1300 buffer: process_handle: 0x000001c4 base_address: 0x00400000	success	1
1619889652.176501 NtSetContextThread	thread_handle: 0x000001c0 registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4394045 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1300	success	0
1619889652.239501 NtResumeThread	thread_handle: 0x000001c0 suspend_count: 1 process_identifier: 1300	success	0
1619889652.411124 NtResumeThread	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 1300	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Trojan.GenericKD.41544517
FireEye	Generic.mg.bf4770b87a6c7728
Qihoo-360	HEUR/QVM10.2.0DC3.Malware.Gen
ALYac	Trojan.GenericKD.41544517
Cylance	Unsafe
Zillya	Trojan.Racealer.Win32.8
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanPSW:Win32/Racealer.2fe6dab9
Arcabit	Trojan.Generic.D279EB45
TrendMicro	TSPY_HPURSNIF.SMZD2
Cyren	W32/Kryptik.AGF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-PSW.Win32.Racealer.gd
BitDefender	Trojan.GenericKD.41544517
NANO-Antivirus	Trojan.Win32.Racealer.ggdkzk
Paloalto	generic.ml
AegisLab	Trojan.Win32.Racealer.i!c
Rising	Trojan.Zpevdo!8.F912 (CLOUD)
Ad-Aware	Trojan.GenericKD.41544517
Emsisoft	Trojan.GenericKD.41544517 (B)
F-Secure	Trojan.TR/AD.MalwareCrypter.rdqmj
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.GandCrab
F-Prot	W32/Kryptik.AGF.gen!Eldorado
Avira	TR/AD.MalwareCrypter.rdqmj
Antiy-AVL	Trojan[PSW]/Win32.Racealer
Microsoft	Trojan:Win32/Tiggre!rfn
Endgame	malicious (high confidence)
ZoneAlarm	Trojan-PSW.Win32.Racealer.gd
GData	Trojan.GenericKD.41544517
AhnLab-V3	Win-Trojan/MalPe34.Suspicious.X2029
Acronis	suspicious
McAfee	Artemis!BF4770B87A6C
TACHYON	Trojan-PWS/W32.Racealer.942592
ESET-NOD32	a variant of Win32/Injector.EIQI
TrendMicro-HouseCall	TSPY_HPURSNIF.SMZD2
Tencent	Win32.Trojan-qqpass.Qqrob.Phqd
Yandex	Trojan.PWS.Racealer!
SentinelOne	DFI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Kryptik.GVSM!tr
BitDefenderTheta	Gen:NN.ZexaF.34108.5y0@ayhLpBoi
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.74483442.susgen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	108.160.170.45:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-08-08 00:06:02

Imports

Library KERNEL32.dll:

• 0x432080 GetConsoleWindow

• 0x432084 SetEndOfFile

• 0x432088 CreateFileW

• 0x43208c ReadConsoleW

• 0x432090 SetStdHandle

• 0x432094 HeapReAlloc

• 0x432098 FreeEnvironmentStringsW

• 0x43209c GetEnvironmentStringsW

• 0x4320a0 GetSystemTimeAsFileTime

• 0x4320a4 QueryPerformanceCounter

• 0x4320a8 GetModuleFileNameA

• 0x4320ac GetOEMCP

• 0x4320b0 GetACP

• 0x4320b4 IsValidCodePage

• 0x4320b8 GetCurrentThreadId

• 0x4320bc LoadLibraryExW

• 0x4320c0 OutputDebugStringW

• 0x4320c4 SetFilePointerEx

• 0x4320c8 ReadFile

• 0x4320cc GetConsoleMode

• 0x4320d0 GetConsoleCP

• 0x4320d4 FlushFileBuffers

• 0x4320d8 GetProcessHeap

• 0x4320dc IsDebuggerPresent

• 0x4320e0 HeapSize

• 0x4320e4 EnumSystemLocalesW

• 0x4320e8 GetUserDefaultLCID

• 0x4320ec IsValidLocale

• 0x4320f0 GetLocaleInfoW

• 0x4320f4 LCMapStringW

• 0x4320f8 SetConsoleTitleA

• 0x4320fc GetModuleHandleW

• 0x432100 GetStartupInfoW

• 0x432104 TlsFree

• 0x432108 TlsSetValue

• 0x43210c TlsGetValue

• 0x432110 TlsAlloc

• 0x432114 TerminateProcess

• 0x432118 InitializeCriticalSectionAndSpinCount

• 0x43211c SetLastError

• 0x432120 SetUnhandledExceptionFilter

• 0x432124 UnhandledExceptionFilter

• 0x432128 GetCPInfo

• 0x43212c GetCommandLineA

• 0x432130 HeapAlloc

• 0x432134 AreFileApisANSI

• 0x432138 ExitProcess

• 0x43213c RtlUnwind

• 0x432140 RaiseException

• 0x432144 WriteConsoleW

• 0x432148 GetModuleHandleExW

• 0x43214c GetFileType

• 0x432150 GetStdHandle

• 0x432154 HeapFree

• 0x432158 IsProcessorFeaturePresent

• 0x43215c GetStringTypeW

• 0x432160 MultiByteToWideChar

• 0x432164 DecodePointer

• 0x432168 EncodePointer

• 0x43216c DeleteCriticalSection

• 0x432170 LeaveCriticalSection

• 0x432174 EnterCriticalSection

• 0x432178 EnumDateFormatsA

• 0x43217c GetConsoleTitleA

• 0x432180 WideCharToMultiByte

• 0x432184 CancelIoEx

• 0x432188 DeleteFileA

• 0x43218c CreateDirectoryA

• 0x432190 GetTempFileNameA

• 0x432194 GetTempPathA

• 0x432198 GetProfileStringA

• 0x43219c GetCommandLineW

• 0x4321a0 GetModuleFileNameW

• 0x4321a4 LoadLibraryA

• 0x4321a8 CreateEventW

• 0x4321ac CreateEventA

• 0x4321b0 GetTickCount

• 0x4321b4 WriteFile

• 0x4321b8 Sleep

• 0x4321bc WaitForSingleObject

• 0x4321c0 GetLastError

• 0x4321c4 GetCurrentProcessId

• 0x4321c8 GlobalFree

• 0x4321cc GlobalAlloc

• 0x4321d0 GetProcAddress

• 0x4321d4 Process32Next

• 0x4321d8 OpenProcess

• 0x4321dc Process32First

• 0x4321e0 CreateToolhelp32Snapshot

• 0x4321e4 OutputDebugStringA

• 0x4321e8 GetModuleHandleA

• 0x4321ec CloseHandle

• 0x4321f0 GetCurrentProcess

Library USER32.dll:

• 0x43224c CallWindowProcA

• 0x432250 RegisterClassExA

• 0x432254 DefWindowProcA

• 0x432258 CreateWindowExA

• 0x43225c IsWindow

• 0x432260 ShowWindow

• 0x432264 SetWindowPos

• 0x432268 GetClassLongA

• 0x43226c PtInRect

• 0x432270 SetClassLongA

• 0x432274 GetDesktopWindow

• 0x432278 FindWindowA

• 0x43227c LoadBitmapA

• 0x432280 DefMDIChildProcA

• 0x432284 DdeSetQualityOfService

• 0x432288 PostMessageA

• 0x43228c SendMessageA

• 0x432290 BeginDeferWindowPos

• 0x432294 DeferWindowPos

• 0x432298 EndDeferWindowPos

• 0x43229c DialogBoxParamA

• 0x4322a0 EndDialog

• 0x4322a4 GetMessageTime

• 0x4322a8 GetMessagePos

• 0x4322ac DdeReconnect

• 0x4322b0 DdeSetUserHandle

• 0x4322b4 GetClassInfoExA

• 0x4322b8 IsRectEmpty

• 0x4322bc GetCursorPos

• 0x4322c0 MessageBoxW

• 0x4322c4 MessageBoxA

• 0x4322c8 GetUpdateRgn

• 0x4322cc EndPaint

• 0x4322d0 BeginPaint

• 0x4322d4 GetDC

• 0x4322d8 TrackPopupMenuEx

• 0x4322dc AppendMenuA

• 0x4322e0 CreatePopupMenu

• 0x4322e4 IsWindowEnabled

• 0x4322e8 MapVirtualKeyA

• 0x4322ec DialogBoxIndirectParamA

• 0x4322f0 CreateDialogParamW

• 0x4322f4 IsWindowVisible

• 0x4322f8 DestroyWindow

• 0x4322fc DispatchMessageA

• 0x432300 TranslateMessage

• 0x432304 GetMessageA

• 0x432308 wsprintfA

• 0x43230c GetGuiResources

• 0x432310 LoadStringA

• 0x432314 LoadImageA

• 0x432318 DestroyIcon

• 0x43231c LoadIconA

• 0x432320 LoadCursorA

• 0x432324 GetWindow

• 0x432328 GetWindowThreadProcessId

• 0x43232c GetClassNameA

• 0x432330 EnumWindows

• 0x432334 GetShellWindow

• 0x432338 SetWindowLongA

• 0x43233c GetWindowLongA

• 0x432340 EqualRect

• 0x432344 CopyRect

• 0x432348 FillRect

• 0x43234c DrawFocusRect

• 0x432350 GetSysColorBrush

• 0x432354 GetSysColor

• 0x432358 MapWindowPoints

• 0x43235c GetWindowRect

• 0x432360 GetClientRect

• 0x432364 GetWindowTextLengthA

• 0x432368 GetWindowTextA

• 0x43236c RedrawWindow

• 0x432370 InvalidateRect

• 0x432374 DrawTextA

• 0x432378 RemoveMenu

• 0x43237c GetSystemMenu

• 0x432380 GetSystemMetrics

• 0x432384 GetDlgItem

Library GDI32.dll:

• 0x432028 DeleteDC

• 0x43202c CreateSolidBrush

• 0x432030 CreateRectRgn

• 0x432034 CreateCompatibleDC

• 0x432038 DeleteObject

• 0x43203c CombineRgn

• 0x432040 BitBlt

• 0x432044 SetTextColor

• 0x432048 SetBkMode

• 0x43204c SetBkColor

• 0x432050 FillRgn

• 0x432054 GetRegionData

• 0x432058 Rectangle

• 0x43205c SelectObject

• 0x432060 StartPage

• 0x432064 GetObjectA

• 0x432068 SetWindowOrgEx

• 0x43206c CreateCompatibleBitmap

• 0x432070 GetStockObject

Library ADVAPI32.dll:

• 0x432000 OpenProcessToken

• 0x432004 LookupPrivilegeValueA

• 0x432008 AdjustTokenPrivileges

Library SHELL32.dll:

• 0x43221c SHBrowseForFolderA

• 0x432220 ExtractIconExA

• 0x432224 SHGetFileInfoW

• 0x432228 SHGetFileInfoA

• 0x43222c CommandLineToArgvW

Library ole32.dll:

• 0x4323bc CoTaskMemFree

Library VERSION.dll:

• 0x43238c GetFileVersionInfoW

Library PSAPI.DLL:

• 0x432208 GetModuleFileNameExA

Library COMCTL32.dll:

• 0x432010

• 0x432014 ImageList_ReplaceIcon

• 0x432018 ImageList_DrawEx

• 0x43201c ImageList_Create

• 0x432020 ImageList_Destroy

Library gdiplus.dll:

• 0x43239c GdipDisposeImage

• 0x4323a0 GdipCloneImage

• 0x4323a4 GdipLoadImageFromFileICM

• 0x4323a8 GdipLoadImageFromFile

• 0x4323ac GdiplusStartup

• 0x4323b0 GdipFree

• 0x4323b4 GdipAlloc

Library IMM32.dll:

• 0x432078 ImmGetVirtualKey

Library SHLWAPI.dll:

• 0x432234 PathFileExistsA

• 0x432238 StrRetToStrA

Library NETAPI32.dll:

• 0x4321f8 NetShareGetInfo

Library RPCRT4.dll:

• 0x432210 UuidToStringA

• 0x432214 UuidCreate

Library dbghelp.dll:

• 0x432394 EnumerateLoadedModules

Library snmpapi.dll:

• 0x4323c4 SnmpUtilMemAlloc

• 0x4323c8 SnmpUtilMemFree

Library NTDSAPI.dll:

• 0x432200 DsGetRdnW

Library TAPI32.dll:

• 0x432240 lineAddToConference

• 0x432244 lineAddProviderA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
drive.google.com	A 108.160.170.45	179.60.193.16
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.