SmartHawk

7.4

高危

58 个模型检测该样本为恶意！

重新分析

下载样本

21aca2ef1f8b32ae7159329993eaa4fb8dd0876acef5f00a4504d94d7dde8740

c3b100b442706ff8e3e64143e5e12b21.exe

分析耗时

106s

最近分析

文件大小

124.0KB

静态报毒动态报毒 100% AI SCORE=86 AIDETECTVM ATTRIBUTE CLASSIC CONFIDENCE DOWNLOAD4 ELDORADO FSJZ GENCIRC HDLG HDWC HIGH CONFIDENCE HIGHCONFIDENCE HKUALH HU2@AUEKLNPJ KRYPTIK MALWARE1 MALWARE@#3M2ZBSD2LU45T MIKEY MUCC PROXYGATE R + MAL R03BC0DJT20 R339538 SCORE STATIC AI SUSGEN SUSPICIOUS PE TEWQL+O2E TRICKBOT TROJANX TWQIT UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trickbot-FSJZ!C3B100B44270	20201211	6.0.6.653
Alibaba	Trojan:Win32/TrickBot.7389a9dc	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Tencent	Malware.Win32.Gencirc.10cdd14a	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861692.703 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00414000	success	0	0
1619896237.38057 NtProtectVirtualMemory	process_identifier: 2448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success	0	0

Foreign language identified in PE resource (1 个事件)

name

RT_VERSION

language

LANG_CHINESE

offset

0x0001c0a0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000002c8

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619896237.41157 NtProtectVirtualMemory	process_identifier: 2448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003d0000	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2440 called NtSetContextThread to modify thread in remote process 2448
1619861693.0 NtSetContextThread	thread_handle: 0x000000cc registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4260288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2448	success	0	0

Executed a process and injected code into it, probably while unpacking (4 个事件)

Time & API	Arguments	Status	Return
1619861692.812 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2440	success	0
1619861692.906 CreateProcessInternalW	thread_identifier: 3008 thread_handle: 0x000000cc process_identifier: 2448 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c3b100b442706ff8e3e64143e5e12b21.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619861692.906 NtGetContextThread	thread_handle: 0x000000cc	success	0
1619861693.0 NtSetContextThread	thread_handle: 0x000000cc registers.eip: 2010382788 registers.esp: 1638384 registers.edi: 0 registers.eax: 4260288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2448	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Mikey.112049
FireEye	Generic.mg.c3b100b442706ff8
McAfee	Trickbot-FSJZ!C3B100B44270
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2037819
Sangfor	Malware
K7AntiVirus	Trojan ( 0056706a1 )
Alibaba	Trojan:Win32/TrickBot.7389a9dc
K7GW	Trojan ( 0056706a1 )
Cybereason	malicious.8c2f82
Arcabit	Trojan.Mikey.D1B5B1
BitDefenderTheta	Gen:NN.ZexaF.34670.hu2@auekLNpj
Cyren	W32/Kryptik.BNI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R03BC0DJT20
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Inject.vho
BitDefender	Gen:Variant.Mikey.112049
NANO-Antivirus	Trojan.Win32.DownLoad4.hkualh
Paloalto	generic.ml
AegisLab	Trojan.Win32.Inject.4!c
Rising	Trojan.Kryptik!1.C6FB (CLASSIC)
Ad-Aware	Gen:Variant.Mikey.112049
Emsisoft	Gen:Variant.Mikey.112049 (B)
Comodo	Malware@#3m2zbsd2lu45t
F-Secure	Trojan.TR/Crypt.Agent.twqit
DrWeb	Trojan.DownLoad4.13317
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R03BC0DJT20
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	Mal/Generic-R + Mal/Trickbot-N
APEX	Malicious
Jiangmin	Trojan.Mucc.azt
Avira	TR/Crypt.Agent.twqit
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Win32.Inject
Microsoft	Trojan:Win32/TrickBot.PVA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Inject.vho
GData	Gen:Variant.Mikey.112049
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Trickbot.R339538
Acronis	suspicious
VBA32	Trojan.Inject
ALYac	Gen:Variant.Mikey.112049
Malwarebytes	Adware.ProxyGate
Ikarus	Trojan.Win32.Crypt
ESET-NOD32	a variant of Win32/Kryptik.HDLG
Tencent	Malware.Win32.Gencirc.10cdd14a

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-28 02:13:04

Imports

Library imagehlp.dll:

• 0x40e134 BindImage

• 0x40e138 SymMatchFileName

• 0x40e13c SymGetOptions

Library ODBC32.dll:

• 0x40e0f8 CursorLibLockDbc

• 0x40e0fc

• 0x40e100

• 0x40e104

• 0x40e108

• 0x40e10c

• 0x40e110

• 0x40e114

Library msi.dll:

• 0x40e144

• 0x40e148

• 0x40e14c

• 0x40e150

• 0x40e154

Library WS2_32.dll:

• 0x40e11c WSACancelBlockingCall

• 0x40e120 WSAInstallServiceClassA

• 0x40e124 WSAGetLastError

• 0x40e128 WSAIoctl

• 0x40e12c WSAStringToAddressA

Library pdh.dll:

• 0x40e15c PdhGetLogFileSize

• 0x40e160 PdhParseCounterPathA

• 0x40e164 PdhMakeCounterPathW

• 0x40e168 PdhVbAddCounter

• 0x40e16c PdhEnumObjectItemsW

• 0x40e170 PdhFormatFromRawValue

Library KERNEL32.dll:

• 0x40e000 EncodePointer

• 0x40e004 WriteConsoleW

• 0x40e008 SetStdHandle

• 0x40e00c CloseHandle

• 0x40e010 LCMapStringW

• 0x40e014 HeapSize

• 0x40e018 SetFilePointerEx

• 0x40e01c GetStringTypeW

• 0x40e020 HeapReAlloc

• 0x40e024 HeapAlloc

• 0x40e028 GetConsoleMode

• 0x40e02c GetConsoleCP

• 0x40e030 FlushFileBuffers

• 0x40e034 OutputDebugStringW

• 0x40e038 LoadLibraryExW

• 0x40e03c RtlUnwind

• 0x40e040 GetCPInfo

• 0x40e044 GetOEMCP

• 0x40e048 GetACP

• 0x40e04c IsValidCodePage

• 0x40e050 HeapFree

• 0x40e054 FreeEnvironmentStringsW

• 0x40e058 VirtualProtect

• 0x40e05c IsDebuggerPresent

• 0x40e060 IsProcessorFeaturePresent

• 0x40e064 GetCommandLineA

• 0x40e068 UnhandledExceptionFilter

• 0x40e06c SetUnhandledExceptionFilter

• 0x40e070 SetLastError

• 0x40e074 InitializeCriticalSectionAndSpinCount

• 0x40e078 Sleep

• 0x40e07c GetCurrentProcess

• 0x40e080 TerminateProcess

• 0x40e084 TlsAlloc

• 0x40e088 TlsGetValue

• 0x40e08c TlsSetValue

• 0x40e090 TlsFree

• 0x40e094 GetStartupInfoW

• 0x40e098 GetModuleHandleW

• 0x40e09c GetProcAddress

• 0x40e0a0 CreateFileW

• 0x40e0a4 DecodePointer

• 0x40e0a8 EnterCriticalSection

• 0x40e0ac LeaveCriticalSection

• 0x40e0b0 GetLastError

• 0x40e0b4 GetCurrentThreadId

• 0x40e0b8 ExitProcess

• 0x40e0bc GetModuleHandleExW

• 0x40e0c0 MultiByteToWideChar

• 0x40e0c4 WideCharToMultiByte

• 0x40e0c8 GetProcessHeap

• 0x40e0cc GetStdHandle

• 0x40e0d0 GetFileType

• 0x40e0d4 DeleteCriticalSection

• 0x40e0d8 GetModuleFileNameA

• 0x40e0dc WriteFile

• 0x40e0e0 GetModuleFileNameW

• 0x40e0e4 QueryPerformanceCounter

• 0x40e0e8 GetCurrentProcessId

• 0x40e0ec GetSystemTimeAsFileTime

• 0x40e0f0 GetEnvironmentStringsW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.