SmartHawk

17.4

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

47921bae52d2d80acb35c1f4ca3e55f4608f76f774713d2578115e74537a897a

c04479081b8da67dec9f6544a3203f29.exe

分析耗时

158s

最近分析

文件大小

602.5KB

静态报毒动态报毒 100% AGEN AGENTTESLA AI SCORE=89 AVSARHER BSK66A CONFIDENCE ELDORADO FAREIT GDSDA GENERICKD HIGH CONFIDENCE HUIMDA KCLOUD KRYPTIK MALWARE@#2Z94K7C8E4T4Z MXRESICN PWSX R349657 SCORE SIGGEN2 SUDLOADER SUWY TASKUN THIBCBO TSCOPE UNSAFE YAKBEEXMSIL 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZD!C04479081B8D	20201206	6.0.6.653
Alibaba	Trojan:MSIL/AgentTesla.5bb4737c	20190527	0.3.0.5
Avast	Win32:PWSX-gen [Trj]	20201206	20.10.5736.0
Baidu		20190318	1.0.0.2
Kingsoft	Win32.Troj.Undef.(kcloud)	20201206	2017.9.26.565
Tencent	Msil.Trojan.Taskun.Suwy	20201206	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619885576.57625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619885578.200375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619885629.481375 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (45 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885523.27925 IsDebuggerPresent		failed	0	0
1619885523.27925 IsDebuggerPresent		failed	0	0
1619885563.76425 IsDebuggerPresent		failed	0	0
1619885564.27925 IsDebuggerPresent		failed	0	0
1619885564.79525 IsDebuggerPresent		failed	0	0
1619885565.27925 IsDebuggerPresent		failed	0	0
1619885565.79525 IsDebuggerPresent		failed	0	0
1619885566.27925 IsDebuggerPresent		failed	0	0
1619885566.79525 IsDebuggerPresent		failed	0	0
1619885567.27925 IsDebuggerPresent		failed	0	0
1619885567.79525 IsDebuggerPresent		failed	0	0
1619885568.27925 IsDebuggerPresent		failed	0	0
1619885568.79525 IsDebuggerPresent		failed	0	0
1619885569.27925 IsDebuggerPresent		failed	0	0
1619885569.79525 IsDebuggerPresent		failed	0	0
1619885570.27925 IsDebuggerPresent		failed	0	0
1619885570.79525 IsDebuggerPresent		failed	0	0
1619885571.27925 IsDebuggerPresent		failed	0	0
1619885571.79525 IsDebuggerPresent		failed	0	0
1619885572.27925 IsDebuggerPresent		failed	0	0
1619885572.79525 IsDebuggerPresent		failed	0	0
1619885573.27925 IsDebuggerPresent		failed	0	0
1619885573.79525 IsDebuggerPresent		failed	0	0
1619885574.27925 IsDebuggerPresent		failed	0	0
1619885574.79525 IsDebuggerPresent		failed	0	0
1619885575.27925 IsDebuggerPresent		failed	0	0
1619885575.79525 IsDebuggerPresent		failed	0	0
1619885576.27925 IsDebuggerPresent		failed	0	0
1619885576.79525 IsDebuggerPresent		failed	0	0
1619885577.27925 IsDebuggerPresent		failed	0	0
1619885577.79525 IsDebuggerPresent		failed	0	0
1619885578.27925 IsDebuggerPresent		failed	0	0
1619885578.79525 IsDebuggerPresent		failed	0	0
1619885579.27925 IsDebuggerPresent		failed	0	0
1619885579.79525 IsDebuggerPresent		failed	0	0
1619885580.27925 IsDebuggerPresent		failed	0	0
1619885580.79525 IsDebuggerPresent		failed	0	0
1619885581.27925 IsDebuggerPresent		failed	0	0
1619885581.79525 IsDebuggerPresent		failed	0	0
1619885582.27925 IsDebuggerPresent		failed	0	0
1619885582.79525 IsDebuggerPresent		failed	0	0
1619885583.27925 IsDebuggerPresent		failed	0	0
1619885583.79525 IsDebuggerPresent		failed	0	0
1619885583.950375 IsDebuggerPresent		failed	0	0
1619885583.950375 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885581.669375 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\lyQXvevRTmdB"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885523.29525 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:2728772845&cup2hreq=27d29bbfc67958780bbcafb054a4317c3ad8855e2a6c6161c583264d9075f26b

Performs some HTTP requests (5 个事件)

request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m
request	GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:2728772845&cup2hreq=27d29bbfc67958780bbcafb054a4317c3ad8855e2a6c6161c583264d9075f26b

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:2728772845&cup2hreq=27d29bbfc67958780bbcafb054a4317c3ad8855e2a6c6161c583264d9075f26b

Allocates read-write-execute memory (usually to unpack itself) (50 out of 157 个事件)

Time & API	Arguments	Status	Return
1619885522.65425 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00930000	success	0
1619885522.65425 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b20000	success	0
1619885523.09225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f60000	success	0
1619885523.09225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02010000	success	0
1619885523.15425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619885523.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00610000	success	0
1619885523.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00660000	success	0
1619885523.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051a000	success	0
1619885523.27925 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619885523.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00512000	success	0
1619885523.57625 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00522000	success	0
1619885523.67025 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00585000	success	0
1619885523.68625 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058b000	success	0
1619885523.68625 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00587000	success	0
1619885523.82625 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00523000	success	0
1619885523.88925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052c000	success	0
1619885524.59225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00524000	success	0
1619885524.59225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00526000	success	0
1619885524.71725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad0000	success	0
1619885524.79525 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00527000	success	0
1619885524.79525 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00536000	success	0
1619885559.38925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0051c000	success	0
1619885559.43625 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad1000	success	0
1619885559.46725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success	0
1619885559.46725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00537000	success	0
1619885559.49825 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00528000	success	0
1619885559.59225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00529000	success	0
1619885559.60725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c80000	success	0
1619885559.67025 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c81000	success	0
1619885559.71725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad2000	success	0
1619885559.71725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c82000	success	0
1619885559.73225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad3000	success	0
1619885559.74825 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad6000	success	0
1619885559.88925 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 452608 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d0400	failed	3221225550
1619885563.21725 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad7000	success	0
1619885563.23225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c83000	success	0
1619885563.23225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052d000	success	0
1619885563.23225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad8000	success	0
1619885563.23225 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ad9000	success	0
1619885563.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ada000	success	0
1619885563.27925 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00adb000	success	0
1619885563.45125 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00adc000	success	0
1619885563.49825 NtAllocateVirtualMemory	process_identifier: 1272 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00add000	success	0
1619885563.49825 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d0178	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d01a0	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d01c8	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d01f0	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x053d0218	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0543f58e	failed	3221225550
1619885563.51425 NtProtectVirtualMemory	process_identifier: 1272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0543f582	failed	3221225550

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\lyQXvevRTmdB.exe

Creates a suspicious process (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\lyQXvevRTmdB" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyQXvevRTmdB" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp"

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\lyQXvevRTmdB.exe

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885577.90425 ShellExecuteExW	parameters: /Create /TN "Updates\lyQXvevRTmdB" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.977236677948674

section

{'size_of_data': '0x00091c00', 'virtual_address': '0x00002000', 'entropy': 7.977236677948674, 'name': '.text', 'virtual_size': '0x00091bd0'}

description

A section with a high entropy has been found

entropy

0.96843853820598

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885559.87325 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619885591.606375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (4 个事件)

Time & API	Arguments	Status
1619885583.68625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3320 process_handle: 0x0000139c	failed
1619885583.68625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3320 process_handle: 0x0000139c	success
1619885626.294375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1272 process_handle: 0x00000238	failed
1619885626.294375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1272 process_handle: 0x00000238	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\lyQXvevRTmdB" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyQXvevRTmdB" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp"

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.40.98

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885583.34225 NtAllocateVirtualMemory	process_identifier: 3320 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005170 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619885583.70125 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00008614 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp78D0.tmp

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1272 manipulating memory of non-child process 3320
1619885583.34225 NtAllocateVirtualMemory	process_identifier: 3320 region_size: 417792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005170 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619885583.70125 WriteProcessMemory	process_identifier: 3380 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELrÿB_àòî @ `@W @ H.textôð ò `.rsrc ô@@.reloc@ú@B process_handle: 0x00008614 base_address: 0x00400000	success	1
1619885583.71725 WriteProcessMemory	process_identifier: 3380 buffer: P8h $#ê4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°äStringFileInfoÀ000004b0,FileDescription 0FileVersion0.0.0.0XInternalNamehRTOKynNphUVYvQLxSytQf.exe(LegalCopyright `OriginalFilenamehRTOKynNphUVYvQLxSytQf.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> process_handle: 0x00008614 base_address: 0x00462000	success	1
1619885583.71725 WriteProcessMemory	process_identifier: 3380 buffer: ð0 process_handle: 0x00008614 base_address: 0x00464000	success	1
1619885583.71725 WriteProcessMemory	process_identifier: 3380 buffer: @ process_handle: 0x00008614 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885583.70125 WriteProcessMemory	process_identifier: 3380 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELrÿB_àòî @ `@W @ H.textôð ò `.rsrc ô@@.reloc@ú@B process_handle: 0x00008614 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1272 called NtSetContextThread to modify thread in remote process 3380
1619885583.71725 NtSetContextThread	thread_handle: 0x0000139c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4591854 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3380	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1272 resumed a thread in remote process 3380
1619885583.74825 NtResumeThread	thread_handle: 0x0000139c suspend_count: 1 process_identifier: 3380	success	0	0

Detects VirtualBox through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619885576.07625 LdrGetProcedureAddress	ordinal: 0 module: KERNEL32 module_address: 0x76340000 function_address: 0x002ece8c function_name: wine_get_unix_file_name	failed	3221225785	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-31 10:13:19

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
redirector.gvt1.com	A 203.208.41.65	203.208.41.33
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.34	203.208.43.66
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49200	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49201	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49195	203.208.40.34 update.googleapis.com	443
192.168.56.101	49199	203.208.41.65 redirector.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53500	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	54991	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m	GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT Range: bytes=0-7546 User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m	GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=dd87de116cfde690&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT Range: bytes=7547-18314 User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619856256&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.