5.8
高危
54 个模型检测该样本为恶意！
重新分析
更多

5fe1e3a80e09c71e09971367027d8cd12c8a2826123d8e1d65a639532d1ed5b4

c027d996125dd5cd9ca955427b9b5ed8.exe

分析耗时

90s

最近分析

文件大小

770.5KB
静态报毒 动态报毒 AI SCORE=85 AIDETECTVM BANKERX BSCOPE CLASSIC DRIDEX ELDORADO ELJF ENCPK GENCIRC GENETIC GENKRYPTIK HDMT HIGH CONFIDENCE HKPUJL INJECT3 KRYPTIK MALICIOUS PE MALWARE1 MALWARE@#1V3S1095OC6FN PINKSBOT QAKBOT QBOT R + MAL R+Y44UMTICY R338192 RAZY SCORE SMTHA STATIC AI TROJANBANKER UNSAFE WQ0@AABTEHMI ZEXAF ZIORM 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee W32/PinkSbot-GS!C027D996125D 20201211 6.0.6.653
CrowdStrike 20190702 1.0
Alibaba TrojanBanker:Win32/Dridex.65158b8c 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
Tencent Malware.Win32.Gencirc.10cdcdd3 20201211 1.0.0.1
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619861591.968375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619866070.175
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619866070.847
__exception__
stacktrace: 
c027d996125dd5cd9ca955427b9b5ed8+0x3f07 @ 0x403f07
c027d996125dd5cd9ca955427b9b5ed8+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 6366528
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: c027d996125dd5cd9ca955427b9b5ed8+0x3449
exception.instruction: in eax, dx
exception.module: c027d996125dd5cd9ca955427b9b5ed8.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
1619866070.847
__exception__
stacktrace: 
c027d996125dd5cd9ca955427b9b5ed8+0x3f10 @ 0x403f10
c027d996125dd5cd9ca955427b9b5ed8+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 6366528
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: c027d996125dd5cd9ca955427b9b5ed8+0x34e2
exception.instruction: in eax, dx
exception.module: c027d996125dd5cd9ca955427b9b5ed8.exe
exception.exception_code: 0xc0000096
exception.offset: 13538
exception.address: 0x4034e2
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619861591.234375
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003b0000
success 0 0
1619861591.718375
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619861591.718375
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619866069.925
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003a0000
success 0 0
1619866070.175
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 221184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619866070.175
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619861592.734375
CreateProcessInternalW
thread_identifier: 2040
thread_handle: 0x0000013c
process_identifier: 1056
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c027d996125dd5cd9ca955427b9b5ed8.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
Expresses interest in specific running processes (1 个事件)
process vboxservice.exe
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619866070.847
__exception__
stacktrace: 
c027d996125dd5cd9ca955427b9b5ed8+0x3f07 @ 0x403f07
c027d996125dd5cd9ca955427b9b5ed8+0x1b25 @ 0x401b25
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 6366528
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: c027d996125dd5cd9ca955427b9b5ed8+0x3449
exception.instruction: in eax, dx
exception.module: c027d996125dd5cd9ca955427b9b5ed8.exe
exception.exception_code: 0xc0000096
exception.offset: 13385
exception.address: 0x403449
success 0 0
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Razy.672135
FireEye Generic.mg.c027d996125dd5cd
McAfee W32/PinkSbot-GS!C027D996125D
Cylance Unsafe
Zillya Trojan.Qbot.Win32.8227
Sangfor Malware
Alibaba TrojanBanker:Win32/Dridex.65158b8c
K7GW Trojan ( 005671d81 )
K7AntiVirus Trojan ( 005671d81 )
Cyren W32/S-ade91e94!Eldorado
Symantec W32.Qakbot
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Razy-8019799-0
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.vho
BitDefender Gen:Variant.Razy.672135
NANO-Antivirus Trojan.Win32.Inject3.hkpujl
Rising Trojan.Kryptik!1.C73F (CLASSIC)
Ad-Aware Gen:Variant.Razy.672135
Emsisoft Gen:Variant.Razy.672135 (B)
Comodo Malware@#1v3s1095oc6fn
F-Secure Trojan.TR/AD.Qbot.ziorm
DrWeb Trojan.Inject3.40630
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.QAKBOT.SMTHA.hp
McAfee-GW-Edition W32/PinkSbot-GS!C027D996125D
Sophos Mal/Generic-R + Mal/EncPk-APV
Ikarus Backdoor.QBot
Jiangmin Trojan.Banker.Qbot.pn
Avira TR/AD.Qbot.ziorm
Antiy-AVL Trojan[Banker]/Win32.Qbot
Microsoft Trojan:Win32/Dridex.RAC!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.vho
GData Gen:Variant.Razy.672135
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.QBot.R338192
BitDefenderTheta Gen:NN.ZexaF.34670.Wq0@aaBteHmi
ALYac Gen:Variant.Razy.672135
MAX malware (ai score=85)
VBA32 BScope.TrojanBanker.Qbot
Malwarebytes Backdoor.Qbot
ESET-NOD32 a variant of Win32/Kryptik.HDMT
TrendMicro-HouseCall TrojanSpy.Win32.QAKBOT.SMTHA.hp
Tencent Malware.Win32.Gencirc.10cdcdd3
Yandex Trojan.Kryptik!r+y44UMtIcY
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_78%
Fortinet W32/GenKryptik.ELJF!tr
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-26 14:24:59

Imports

Library KERNEL32.dll:
• 0x4c1904 GetDriveTypeA
• 0x4c1908 GetTickCount
• 0x4c190c GetLocalTime
• 0x4c1910 WriteFile
• 0x4c1918 SetFilePointer
• 0x4c191c ReadFile
• 0x4c1920 MoveFileExA
• 0x4c1924 CopyFileA
• 0x4c1930 GetLongPathNameA
• 0x4c1934 GlobalAlloc
• 0x4c1938 GlobalFree
• 0x4c193c SetFileAttributesA
• 0x4c1940 DeleteFileA
• 0x4c1944 GetSystemTime
• 0x4c1948 GetComputerNameA
• 0x4c194c CreateDirectoryA
• 0x4c1954 FindFirstFileA
• 0x4c1958 FindNextFileA
• 0x4c195c FindClose
• 0x4c1960 GetLastError
• 0x4c1968 ResetEvent
• 0x4c196c SetEvent
• 0x4c1970 CreateEventA
• 0x4c1984 WaitForSingleObject
• 0x4c1988 GetModuleHandleA
• 0x4c1994 LocalFree
• 0x4c1998 FormatMessageA
• 0x4c199c GetFileType
• 0x4c19a0 FlushFileBuffers
• 0x4c19a4 GlobalDeleteAtom
• 0x4c19a8 GlobalUnlock
• 0x4c19ac GlobalLock
• 0x4c19b0 MultiByteToWideChar
• 0x4c19b8 DeleteAtom
• 0x4c19bc GetCurrentThreadId
• 0x4c19c0 AddAtomA
• 0x4c19c4 RtlUnwind
• 0x4c19c8 RaiseException
• 0x4c19cc HeapFree
• 0x4c19d0 HeapReAlloc
• 0x4c19d4 HeapAlloc
• 0x4c19d8 ExitThread
• 0x4c19dc CreateThread
• 0x4c19e0 GetStartupInfoA
• 0x4c19e4 GetCommandLineA
• 0x4c19e8 ExitProcess
• 0x4c19ec WideCharToMultiByte
• 0x4c19f0 TlsAlloc
• 0x4c19f4 SetLastError
• 0x4c19f8 TlsFree
• 0x4c19fc TlsSetValue
• 0x4c1a00 TlsGetValue
• 0x4c1a04 GetACP
• 0x4c1a08 GetOEMCP
• 0x4c1a0c GetCPInfo
• 0x4c1a10 LCMapStringA
• 0x4c1a14 LCMapStringW
• 0x4c1a1c HeapDestroy
• 0x4c1a20 HeapCreate
• 0x4c1a24 VirtualFree
• 0x4c1a28 VirtualAlloc
• 0x4c1a2c IsBadWritePtr
• 0x4c1a34 HeapSize
• 0x4c1a38 GetStdHandle
• 0x4c1a4c SetHandleCount
• 0x4c1a50 CompareStringA
• 0x4c1a54 CompareStringW
• 0x4c1a58 GetStringTypeA
• 0x4c1a5c GetStringTypeW
• 0x4c1a60 IsBadReadPtr
• 0x4c1a64 IsBadCodePtr
• 0x4c1a68 GetLocaleInfoA
• 0x4c1a6c VirtualProtect
• 0x4c1a70 GetSystemInfo
• 0x4c1a74 InterlockedExchange
• 0x4c1a78 SetStdHandle
• 0x4c1a80 TerminateProcess
• 0x4c1a84 LoadLibraryA
• 0x4c1a88 lstrlenA
• 0x4c1a8c DebugBreak
• 0x4c1a90 GetStartupInfoW
• 0x4c1a94 CloseHandle
• 0x4c1a98 VirtualQuery
• 0x4c1a9c CreateFileW
• 0x4c1aa0 lstrcpyW
• 0x4c1aa4 GetModuleFileNameW
• 0x4c1aa8 IsDebuggerPresent
• 0x4c1aac lstrlenW
• 0x4c1ab0 GetCurrentProcess
• 0x4c1ab4 GetCurrentProcessId
• 0x4c1ab8 GetFileTime
• 0x4c1abc GetFileSize
• 0x4c1ac4 GlobalMemoryStatus
• 0x4c1acc CreateProcessW
• 0x4c1ad0 lstrcatW
• 0x4c1ad4 GetProcAddress
• 0x4c1ad8 GetModuleHandleW
• 0x4c1adc GetVersionExW
• 0x4c1ae0 GetProcessHeap
• 0x4c1ae8 DeviceIoControl
• 0x4c1af0 Sleep
• 0x4c1af4 FreeLibrary
Library USER32.dll:
• 0x4c1afc SetDeskWallpaper
• 0x4c1b08 MessageBoxA
• 0x4c1b0c ExitWindowsEx
• 0x4c1b10 LoadIconA
• 0x4c1b14 LoadCursorFromFileW
Library ADVAPI32.dll:
• 0x4c1b1c RegCloseKey
• 0x4c1b20 RegOpenKeyA
• 0x4c1b24 RegQueryValueExA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.