SmartHawk

10.2

0-day

53 个模型检测该样本为恶意！

重新分析

下载样本

0a4302afdce0b4fd1b3ea38667bfc19096c24381854a7b5c10a8d459cf5f6ded

c2ce86568922aa146d11b3a13a1c5e0c.exe

分析耗时

104s

最近分析

文件大小

767.0KB

静态报毒动态报毒 AGENTTESLA AI SCORE=87 ATTRIBUTE CLOUD CONFIDENCE DXENW ELDORADO FAREIT FVTN GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK PACKEDNET QVM03 R002C0DHB20 R347306 RATX SCORE SUSGEN SUSPICIOUS PE SYRU UNCLASSIFIEDMALWARE@0 UNSAFE VM0@AE7SP3H ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Alibaba	Trojan:MSIL/AgentTesla.6722092a	20190527	0.3.0.5
Tencent	Msil.Trojan.Crypt.Syru	20200819	1.0.0.1
Kingsoft		20200819	2013.8.14.323
McAfee	Fareit-FXH!C2CE86568922	20200819	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619867064.83975 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619867067.33975 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (50 out of 98 个事件)

Time & API	Arguments	Status	Return	Repeated
1619866995.621875 IsDebuggerPresent		failed	0	0
1619866995.621875 IsDebuggerPresent		failed	0	0
1619866998.089875 IsDebuggerPresent		failed	0	0
1619866998.589875 IsDebuggerPresent		failed	0	0
1619866999.105875 IsDebuggerPresent		failed	0	0
1619866999.589875 IsDebuggerPresent		failed	0	0
1619867000.105875 IsDebuggerPresent		failed	0	0
1619867000.589875 IsDebuggerPresent		failed	0	0
1619867001.105875 IsDebuggerPresent		failed	0	0
1619867001.589875 IsDebuggerPresent		failed	0	0
1619867002.105875 IsDebuggerPresent		failed	0	0
1619867002.589875 IsDebuggerPresent		failed	0	0
1619867003.105875 IsDebuggerPresent		failed	0	0
1619867003.589875 IsDebuggerPresent		failed	0	0
1619867004.105875 IsDebuggerPresent		failed	0	0
1619867004.589875 IsDebuggerPresent		failed	0	0
1619867005.105875 IsDebuggerPresent		failed	0	0
1619867005.589875 IsDebuggerPresent		failed	0	0
1619867006.105875 IsDebuggerPresent		failed	0	0
1619867006.589875 IsDebuggerPresent		failed	0	0
1619867007.105875 IsDebuggerPresent		failed	0	0
1619867007.589875 IsDebuggerPresent		failed	0	0
1619867008.105875 IsDebuggerPresent		failed	0	0
1619867008.589875 IsDebuggerPresent		failed	0	0
1619867009.105875 IsDebuggerPresent		failed	0	0
1619867009.589875 IsDebuggerPresent		failed	0	0
1619867010.105875 IsDebuggerPresent		failed	0	0
1619867010.589875 IsDebuggerPresent		failed	0	0
1619867011.105875 IsDebuggerPresent		failed	0	0
1619867011.589875 IsDebuggerPresent		failed	0	0
1619867012.105875 IsDebuggerPresent		failed	0	0
1619867012.589875 IsDebuggerPresent		failed	0	0
1619867013.105875 IsDebuggerPresent		failed	0	0
1619867013.589875 IsDebuggerPresent		failed	0	0
1619867014.105875 IsDebuggerPresent		failed	0	0
1619867014.589875 IsDebuggerPresent		failed	0	0
1619867015.105875 IsDebuggerPresent		failed	0	0
1619867015.589875 IsDebuggerPresent		failed	0	0
1619867016.105875 IsDebuggerPresent		failed	0	0
1619867016.589875 IsDebuggerPresent		failed	0	0
1619867017.105875 IsDebuggerPresent		failed	0	0
1619867017.589875 IsDebuggerPresent		failed	0	0
1619867018.105875 IsDebuggerPresent		failed	0	0
1619867018.589875 IsDebuggerPresent		failed	0	0
1619867019.105875 IsDebuggerPresent		failed	0	0
1619867019.589875 IsDebuggerPresent		failed	0	0
1619867020.105875 IsDebuggerPresent		failed	0	0
1619867020.589875 IsDebuggerPresent		failed	0	0
1619867021.105875 IsDebuggerPresent		failed	0	0
1619867021.589875 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619866995.636875 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 163 个事件)

Time & API	Arguments	Status	Return
1619866992.402875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003d0000	success	0
1619866992.402875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00410000	success	0
1619866995.230875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02100000	success	0
1619866995.230875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022f0000	success	0
1619866995.449875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619866995.621875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02330000	success	0
1619866995.621875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02500000	success	0
1619866995.621875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success	0
1619866995.636875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619866995.636875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success	0
1619866996.386875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success	0
1619866996.636875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00455000	success	0
1619866996.636875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success	0
1619866996.636875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success	0
1619866996.808875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success	0
1619866996.824875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fc000	success	0
1619866996.871875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00590000	success	0
1619866997.136875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f4000	success	0
1619866998.277875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f5000	success	0
1619866998.324875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success	0
1619866998.527875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success	0
1619866998.527875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success	0
1619866998.699875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success	0
1619866998.808875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00591000	success	0
1619866999.230875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00594000	success	0
1619866999.246875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f8000	success	0
1619867040.324875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00595000	success	0
1619867040.355875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022f1000	success	0
1619867040.496875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00596000	success	0
1619867040.652875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ec000	success	0
1619867040.652875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success	0
1619867040.761875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f9000	success	0
1619867040.761875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00598000	success	0
1619867040.777875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00599000	success	0
1619867040.902875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 289280 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a00400	failed	3221225550
1619867043.027875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059a000	success	0
1619867043.027875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c70000	success	0
1619867043.043875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success	0
1619867043.043875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059c000	success	0
1619867043.074875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059d000	success	0
1619867043.074875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059e000	success	0
1619867043.230875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05060000	success	0
1619867043.230875 NtAllocateVirtualMemory	process_identifier: 1316 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05061000	success	0
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a00178	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a001a0	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a001c8	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a001f0	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a00218	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a4774e	failed	3221225550
1619867043.230875 NtProtectVirtualMemory	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04a47742	failed	3221225550

A process attempted to delay the analysis task. (1 个事件)

description

c2ce86568922aa146d11b3a13a1c5e0c.exe tried to sleep 143 seconds, actually delayed analysis time by 143 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.620659738296166

section

{'size_of_data': '0x00087800', 'virtual_address': '0x00002000', 'entropy': 7.620659738296166, 'name': '.text', 'virtual_size': '0x00087754'}

description

A section with a high entropy has been found

entropy

0.7071102413568167

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619866997.246875 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619867056.07475 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619867062.05875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1316 process_handle: 0x00000234	failed	0	0
1619867062.05875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1316 process_handle: 0x00000234	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619867043.730875 NtAllocateVirtualMemory	process_identifier: 2516 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006da0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619867043.730875 WriteProcessMemory	process_identifier: 2516 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELSÞ^à\¾z @ À@dzWè H.textÄZ \ `.rsrcè^@@.reloc b@B process_handle: 0x00006da0 base_address: 0x00400000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNamevuTbCLDKveZSJqSbnqvgrsQmO.exe(LegalCopyright dOriginalFilenamevuTbCLDKveZSJqSbnqvgrsQmO.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00006da0 base_address: 0x00448000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: pÀ: process_handle: 0x00006da0 base_address: 0x0044a000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: @ process_handle: 0x00006da0 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619867043.730875 WriteProcessMemory	process_identifier: 2516 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELSÞ^à\¾z @ À@dzWè H.textÄZ \ `.rsrcè^@@.reloc b@B process_handle: 0x00006da0 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1316 called NtSetContextThread to modify thread in remote process 2516
1619867043.746875 NtSetContextThread	thread_handle: 0x0000532c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4487870 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2516	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1316 resumed a thread in remote process 2516
1619867043.839875 NtResumeThread	thread_handle: 0x0000532c suspend_count: 1 process_identifier: 2516	success	0	0

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1619866995.621875 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1316	success	0
1619866995.636875 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 1316	success	0
1619866995.668875 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 1316	success	0
1619866997.668875 NtResumeThread	thread_handle: 0x00000208 suspend_count: 1 process_identifier: 1316	success	0
1619866997.949875 NtResumeThread	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 1316	success	0
1619867043.246875 NtResumeThread	thread_handle: 0x00005398 suspend_count: 1 process_identifier: 1316	success	0
1619867043.246875 NtResumeThread	thread_handle: 0x0000ce90 suspend_count: 1 process_identifier: 1316	success	0
1619867043.730875 CreateProcessInternalW	thread_identifier: 952 thread_handle: 0x0000532c process_identifier: 2516 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c2ce86568922aa146d11b3a13a1c5e0c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c2ce86568922aa146d11b3a13a1c5e0c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00006da0 inherit_handles: 0	success	1
1619867043.730875 NtGetContextThread	thread_handle: 0x0000532c	success	0
1619867043.730875 NtAllocateVirtualMemory	process_identifier: 2516 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006da0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619867043.730875 WriteProcessMemory	process_identifier: 2516 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELSÞ^à\¾z @ À@dzWè H.textÄZ \ `.rsrcè^@@.reloc b@B process_handle: 0x00006da0 base_address: 0x00400000	success	1
1619867043.730875 WriteProcessMemory	process_identifier: 2516 buffer: process_handle: 0x00006da0 base_address: 0x00402000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNamevuTbCLDKveZSJqSbnqvgrsQmO.exe(LegalCopyright dOriginalFilenamevuTbCLDKveZSJqSbnqvgrsQmO.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00006da0 base_address: 0x00448000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: pÀ: process_handle: 0x00006da0 base_address: 0x0044a000	success	1
1619867043.746875 WriteProcessMemory	process_identifier: 2516 buffer: @ process_handle: 0x00006da0 base_address: 0x7efde008	success	1
1619867043.746875 NtSetContextThread	thread_handle: 0x0000532c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4487870 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2516	success	0
1619867043.839875 NtResumeThread	thread_handle: 0x0000532c suspend_count: 1 process_identifier: 2516	success	0
1619867044.01175 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2516	success	0
1619867044.01175 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2516	success	0
1619867044.02775 NtResumeThread	thread_handle: 0x0000019c suspend_count: 1 process_identifier: 2516	success	0
1619867067.23075 NtResumeThread	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2516	success	0
1619867067.26175 NtResumeThread	thread_handle: 0x00000314 suspend_count: 1 process_identifier: 2516	success	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34328892
FireEye	Generic.mg.c2ce86568922aa14
CAT-QuickHeal	Trojan.MSIL
Qihoo-360	Generic/HEUR/QVM03.0.256B.Malware.Gen
ALYac	Trojan.GenericKD.34328892
Cylance	Unsafe
AegisLab	Trojan.Multi.Generic.4!c
K7AntiVirus	Trojan ( 0056c2781 )
BitDefender	Trojan.GenericKD.34328892
K7GW	Trojan ( 0056c2781 )
Cybereason	malicious.dc9158
Invincea	heuristic
F-Prot	W32/MSIL_Agent.BNY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
Alibaba	Trojan:MSIL/AgentTesla.6722092a
ViRobot	Trojan.Win32.Z.Kryptik.785408.K
Tencent	Msil.Trojan.Crypt.Syru
Ad-Aware	Trojan.GenericKD.34328892
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Kryptik.dxenw
DrWeb	Trojan.PackedNET.406
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DHB20
Sophos	Mal/Generic-S
SentinelOne	DFI - Suspicious PE
Cyren	W32/MSIL_Agent.BNY.gen!Eldorado
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.dxenw
MAX	malware (ai score=87)
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
Arcabit	Trojan.Generic.D20BD13C
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.34328892
Cynet	Malicious (score: 90)
AhnLab-V3	Trojan/Win32.Kryptik.R347306
McAfee	Fareit-FXH!C2CE86568922
Malwarebytes	Trojan.MalPack.FVTN
ESET-NOD32	a variant of MSIL/Kryptik.XHJ
TrendMicro-HouseCall	TROJ_GEN.R002C0DHB20
Rising	Trojan.AgentTesla!8.104D5 (CLOUD)
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_64%
Fortinet	MSIL/Kryptik.XIB!tr
BitDefenderTheta	Gen:NN.ZemsilF.34182.Vm0@ae7sP3h
AVG	Win32:RATX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-10 10:22:07

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.