SmartHawk

10.2

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

1c94475216a36fd670d2d6512f4a4347f809847a0491b768f81fa33fa00ccc83

c5e7345ea96addff57be87be8b772090.exe

分析耗时

101s

最近分析

文件大小

490.0KB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=100 ATTRIBUTE CLOUD CONFIDENCE ELDORADO EM0@A8XJKEN FAREIT FORMBOOK GDSDA GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE HPXKPF KRYPTIK MALICIOUS PE MALWAREX NONAME@0 R049C0DH120 RWUKO SCORE SIGGEN2 SUSGEN TAOT TSCOPE UNSAFE ZEMSILCO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXO!C5E7345EA96A	20200823	6.0.6.653
Alibaba	Trojan:MSIL/AgentTesla.c2a2ddc2	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200823	18.4.3895.0
Kingsoft		20200823	2013.8.14.323
Tencent	Msil.Trojan.Crypt.Taot	20200823	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks if process is being debugged by a debugger (5 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929323.055625 IsDebuggerPresent		failed	0	0
1619929323.055625 IsDebuggerPresent		failed	0	0
1619929375.805625 IsDebuggerPresent		failed	0	0
1619929376.273 IsDebuggerPresent		failed	0	0
1619929376.273 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929323.070625 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 127 个事件)

Time & API	Arguments	Status	Return
1619929322.133625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00600000	success	0
1619929322.133625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006a0000	success	0
1619929322.789625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f10000	success	0
1619929322.789625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020f0000	success	0
1619929322.898625 NtProtectVirtualMemory	process_identifier: 708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619929323.055625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f10000	success	0
1619929323.055625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01fe0000	success	0
1619929323.055625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0060a000	success	0
1619929323.055625 NtProtectVirtualMemory	process_identifier: 708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619929323.055625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00602000	success	0
1619929323.258625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00612000	success	0
1619929323.351625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00635000	success	0
1619929323.351625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0063b000	success	0
1619929323.351625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00637000	success	0
1619929323.508625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00613000	success	0
1619929323.523625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061c000	success	0
1619929324.242625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00614000	success	0
1619929324.242625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00616000	success	0
1619929324.383625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f60000	success	0
1619929324.555625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00617000	success	0
1619929324.601625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0062a000	success	0
1619929324.601625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00627000	success	0
1619929325.820625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00618000	success	0
1619929325.820625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00626000	success	0
1619929325.851625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061a000	success	0
1619929326.336625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00619000	success	0
1619929327.492625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02050000	success	0
1619929327.945625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f61000	success	0
1619929328.836625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02051000	success	0
1619929329.680625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f62000	success	0
1619929329.883625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02052000	success	0
1619929330.023625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f63000	success	0
1619929330.070625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f65000	success	0
1619929371.461625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f66000	success	0
1619929371.851625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020f1000	success	0
1619929372.117625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f67000	success	0
1619929372.258625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061d000	success	0
1619929372.258625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0060c000	success	0
1619929372.320625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f68000	success	0
1619929372.367625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02053000	success	0
1619929372.367625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02054000	success	0
1619929372.383625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f69000	success	0
1619929372.695625 NtProtectVirtualMemory	process_identifier: 708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 323072 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05f50400	failed	3221225550
1619929375.008625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6a000	success	0
1619929375.008625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6b000	success	0
1619929375.008625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02055000	success	0
1619929375.039625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6c000	success	0
1619929375.039625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6d000	success	0
1619929375.070625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6e000	success	0
1619929375.211625 NtAllocateVirtualMemory	process_identifier: 708 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f6f000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.85821028430349

section

{'size_of_data': '0x00079e00', 'virtual_address': '0x00002000', 'entropy': 7.85821028430349, 'name': '.text', 'virtual_size': '0x00079dd0'}

description

A section with a high entropy has been found

entropy

0.9959141981613892

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929372.633625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929376.070625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2016 process_handle: 0x0000ee5c	failed	0	0
1619929376.070625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2016 process_handle: 0x0000ee5c	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929375.976625 NtAllocateVirtualMemory	process_identifier: 2016 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00009790 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619929376.086625 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00007c44 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 708 manipulating memory of non-child process 2016
1619929375.976625 NtAllocateVirtualMemory	process_identifier: 2016 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00009790 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619929376.086625 WriteProcessMemory	process_identifier: 2080 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn _àLîj @ À@jOè H.textôJ L `.rsrcèN@@.reloc R@B process_handle: 0x00007c44 base_address: 0x00400000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNameJwasrMsvmEhvAMcbCxcNVkFG.exe(LegalCopyright dOriginalFilenameJwasrMsvmEhvAMcbCxcNVkFG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00007c44 base_address: 0x00448000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: `ð: process_handle: 0x00007c44 base_address: 0x0044a000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: @ process_handle: 0x00007c44 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619929376.086625 WriteProcessMemory	process_identifier: 2080 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn _àLîj @ À@jOè H.textôJ L `.rsrcèN@@.reloc R@B process_handle: 0x00007c44 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 708 called NtSetContextThread to modify thread in remote process 2080
1619929376.101625 NtSetContextThread	thread_handle: 0x0000ee5c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483822 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2080	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 708 resumed a thread in remote process 2080
1619929376.117625 NtResumeThread	thread_handle: 0x0000ee5c suspend_count: 1 process_identifier: 2080	success	0	0

Executed a process and injected code into it, probably while unpacking (21 个事件)

Time & API	Arguments	Status	Return
1619929323.055625 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 708	success	0
1619929323.055625 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 708	success	0
1619929323.070625 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 708	success	0
1619929375.773625 NtResumeThread	thread_handle: 0x00001848 suspend_count: 1 process_identifier: 708	success	0
1619929375.773625 NtResumeThread	thread_handle: 0x00003988 suspend_count: 1 process_identifier: 708	success	0
1619929375.961625 CreateProcessInternalW	thread_identifier: 2036 thread_handle: 0x00000e40 process_identifier: 2016 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c5e7345ea96addff57be87be8b772090.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c5e7345ea96addff57be87be8b772090.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00009790 inherit_handles: 0	success	1
1619929375.976625 NtGetContextThread	thread_handle: 0x00000e40	success	0
1619929375.976625 NtAllocateVirtualMemory	process_identifier: 2016 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00009790 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619929376.086625 CreateProcessInternalW	thread_identifier: 916 thread_handle: 0x0000ee5c process_identifier: 2080 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c5e7345ea96addff57be87be8b772090.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c5e7345ea96addff57be87be8b772090.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00007c44 inherit_handles: 0	success	1
1619929376.086625 NtGetContextThread	thread_handle: 0x0000ee5c	success	0
1619929376.086625 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00007c44 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619929376.086625 WriteProcessMemory	process_identifier: 2080 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELn _àLîj @ À@jOè H.textôJ L `.rsrcèN@@.reloc R@B process_handle: 0x00007c44 base_address: 0x00400000	success	1
1619929376.086625 WriteProcessMemory	process_identifier: 2080 buffer: process_handle: 0x00007c44 base_address: 0x00402000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: 0HX4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ìStringFileInfoÈ000004b0,FileDescription 0FileVersion0.0.0.0\InternalNameJwasrMsvmEhvAMcbCxcNVkFG.exe(LegalCopyright dOriginalFilenameJwasrMsvmEhvAMcbCxcNVkFG.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x00007c44 base_address: 0x00448000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: `ð: process_handle: 0x00007c44 base_address: 0x0044a000	success	1
1619929376.101625 WriteProcessMemory	process_identifier: 2080 buffer: @ process_handle: 0x00007c44 base_address: 0x7efde008	success	1
1619929376.101625 NtSetContextThread	thread_handle: 0x0000ee5c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4483822 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2080	success	0
1619929376.117625 NtResumeThread	thread_handle: 0x0000ee5c suspend_count: 1 process_identifier: 2080	success	0
1619929376.273 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2080	success	0
1619929376.273 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 2080	success	0
1619929376.289 NtResumeThread	thread_handle: 0x000001a8 suspend_count: 1 process_identifier: 2080	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43572882
FireEye	Generic.mg.c5e7345ea96addff
CAT-QuickHeal	Trojan.MSIL
McAfee	Fareit-FXO!C5E7345EA96A
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ba881 )
Alibaba	Trojan:MSIL/AgentTesla.c2a2ddc2
K7GW	Trojan ( 0056ba881 )
Cybereason	malicious.b90762
Arcabit	Trojan.Generic.D298DE92
TrendMicro	TROJ_GEN.R049C0DH120
Cyren	W32/MSIL_Kryptik.BGQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Formbook-9215845-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.43572882
NANO-Antivirus	Trojan.Win32.Crypt.hpxkpf
ViRobot	Trojan.Win32.Z.Kryptik.501760.AE
Avast	Win32:MalwareX-gen [Trj]
Rising	Trojan.Crypt!8.2E3 (CLOUD)
Ad-Aware	Trojan.GenericKD.43572882
Sophos	Mal/Generic-S
Comodo	fls.noname@0
F-Secure	Trojan.TR/Kryptik.rwuko
DrWeb	Trojan.PWS.Siggen2.52918
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Emsisoft	Trojan.GenericKD.43572882 (B)
Ikarus	Trojan.MSIL.Inject
Avira	TR/Kryptik.rwuko
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:MSIL/AgentTesla.VN!MTB
AegisLab	Trojan.MSIL.Crypt.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.43572882
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.AgentTesla.C4173453
BitDefenderTheta	Gen:NN.ZemsilCO.34186.Em0@a8XJkEn
ALYac	Trojan.GenericKD.43572882
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XDP
TrendMicro-HouseCall	TROJ_GEN.R049C0DH120
Tencent	Msil.Trojan.Crypt.Taot
SentinelOne	DFI - Malicious PE

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-31 17:51:34

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.