SmartHawk

7.6

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

32a3ecf1c16bf5ed5732d42a01d2a631ef1f802762b711b2997b7743bdee310a

c6b1209cba142c72b1743deaa1fe3cbf.exe

分析耗时

92s

最近分析

文件大小

548.5KB

静态报毒动态报毒 AGENSLA AI SCORE=83 ATTRIBUTE CLOUD CONFIDENCE ELDORADO FAREIT GENERICKD HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE IM0@AIYTGZL IVLAR KRYPTIK MALICIOUS PE MALWAREX MASSLOGGER NANOCORE R002C0WH720 R347027 SCORE SKEEYAH SZUV UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Kryptik.6afc2397	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20200817	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200817	2013.8.14.323
McAfee	Fareit-FXH!C6B1209CBA14	20200817	6.0.6.653
Tencent	Msil.Trojan.Crypt.Szuv	20200817	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Checks if process is being debugged by a debugger (3 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906627.968125 IsDebuggerPresent		failed	0	0
1619906627.968125 IsDebuggerPresent		failed	0	0
1619906677.125125 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906628.000125 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 个事件)

Time & API	Arguments	Status	Return
1619906622.734125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00760000	success	0
1619906622.734125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00800000	success	0
1619906627.750125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00840000	success	0
1619906627.750125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f0000	success	0
1619906627.922125 NtProtectVirtualMemory	process_identifier: 920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619906627.968125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02080000	success	0
1619906627.968125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success	0
1619906627.968125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success	0
1619906627.968125 NtProtectVirtualMemory	process_identifier: 920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619906627.968125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00442000	success	0
1619906628.500125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success	0
1619906628.593125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success	0
1619906628.593125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047b000	success	0
1619906628.593125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success	0
1619906628.734125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00453000	success	0
1619906628.765125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045c000	success	0
1619906628.843125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00610000	success	0
1619906629.406125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00454000	success	0
1619906629.406125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00456000	success	0
1619906629.547125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success	0
1619906629.593125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00458000	success	0
1619906629.609125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00611000	success	0
1619906629.672125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success	0
1619906629.672125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00467000	success	0
1619906629.812125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00466000	success	0
1619906629.828125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00612000	success	0
1619906630.125125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success	0
1619906630.265125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00459000	success	0
1619906631.781125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00870000	success	0
1619906631.922125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00617000	success	0
1619906631.984125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00618000	success	0
1619906632.281125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061a000	success	0
1619906632.343125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00871000	success	0
1619906632.422125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00872000	success	0
1619906632.422125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061b000	success	0
1619906632.437125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00873000	success	0
1619906632.453125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061c000	success	0
1619906632.468125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0061f000	success	0
1619906632.468125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045d000	success	0
1619906673.484125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00874000	success	0
1619906673.484125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b0000	success	0
1619906673.484125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f1000	success	0
1619906673.656125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b1000	success	0
1619906673.687125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b2000	success	0
1619906673.812125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044c000	success	0
1619906673.875125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b3000	success	0
1619906673.922125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00875000	success	0
1619906673.937125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b4000	success	0
1619906674.125125 NtProtectVirtualMemory	process_identifier: 920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 254976 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04430400	failed	3221225550
1619906676.297125 NtAllocateVirtualMemory	process_identifier: 920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x043b5000	success	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.60284116037665

section

{'size_of_data': '0x00088600', 'virtual_address': '0x00002000', 'entropy': 7.60284116037665, 'name': '.text', 'virtual_size': '0x00088424'}

description

A section with a high entropy has been found

entropy

0.9954379562043796

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906674.125125 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619906677.328125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3140 process_handle: 0x00006f7c	failed
1619906677.328125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3140 process_handle: 0x00006f7c	success
1619906677.375125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3204 process_handle: 0x00005d98	failed
1619906677.375125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3204 process_handle: 0x00005d98	success
1619906677.406125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3264 process_handle: 0x00010eac	failed
1619906677.406125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3264 process_handle: 0x00010eac	success
1619906677.453125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3324 process_handle: 0x0000845c	failed
1619906677.453125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3324 process_handle: 0x0000845c	success
1619906677.484125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3384 process_handle: 0x00010eb0	failed
1619906677.484125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3384 process_handle: 0x00010eb0	success

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.40.34

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619906677.250125 NtAllocateVirtualMemory	process_identifier: 3140 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010ea4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.343125 NtAllocateVirtualMemory	process_identifier: 3204 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000c81c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.390125 NtAllocateVirtualMemory	process_identifier: 3264 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000045d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.422125 NtAllocateVirtualMemory	process_identifier: 3324 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004384 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.468125 NtAllocateVirtualMemory	process_identifier: 3384 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000d960 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 920 manipulating memory of non-child process 3140
Process injection	Process 920 manipulating memory of non-child process 3204
Process injection	Process 920 manipulating memory of non-child process 3264
Process injection	Process 920 manipulating memory of non-child process 3324
Process injection	Process 920 manipulating memory of non-child process 3384
1619906677.250125 NtAllocateVirtualMemory	process_identifier: 3140 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010ea4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619906677.343125 NtAllocateVirtualMemory	process_identifier: 3204 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000c81c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619906677.390125 NtAllocateVirtualMemory	process_identifier: 3264 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000045d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619906677.422125 NtAllocateVirtualMemory	process_identifier: 3324 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004384 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619906677.468125 NtAllocateVirtualMemory	process_identifier: 3384 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000d960 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Executed a process and injected code into it, probably while unpacking (20 个事件)

Time & API	Arguments	Status	Return
1619906627.968125 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 920	success	0
1619906627.984125 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 920	success	0
1619906628.093125 NtResumeThread	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 920	success	0
1619906677.109125 NtResumeThread	thread_handle: 0x00010e9c suspend_count: 1 process_identifier: 920	success	0
1619906677.109125 NtResumeThread	thread_handle: 0x0000788c suspend_count: 1 process_identifier: 920	success	0
1619906677.250125 CreateProcessInternalW	thread_identifier: 3144 thread_handle: 0x0000e140 process_identifier: 3140 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00010ea4 inherit_handles: 0	success	1
1619906677.250125 NtGetContextThread	thread_handle: 0x0000e140	success	0
1619906677.250125 NtAllocateVirtualMemory	process_identifier: 3140 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00010ea4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.343125 CreateProcessInternalW	thread_identifier: 3208 thread_handle: 0x00006f7c process_identifier: 3204 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000c81c inherit_handles: 0	success	1
1619906677.343125 NtGetContextThread	thread_handle: 0x00006f7c	success	0
1619906677.343125 NtAllocateVirtualMemory	process_identifier: 3204 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000c81c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.390125 CreateProcessInternalW	thread_identifier: 3268 thread_handle: 0x00005d98 process_identifier: 3264 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000045d0 inherit_handles: 0	success	1
1619906677.390125 NtGetContextThread	thread_handle: 0x00005d98	success	0
1619906677.390125 NtAllocateVirtualMemory	process_identifier: 3264 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000045d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.422125 CreateProcessInternalW	thread_identifier: 3328 thread_handle: 0x00010eac process_identifier: 3324 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00004384 inherit_handles: 0	success	1
1619906677.422125 NtGetContextThread	thread_handle: 0x00010eac	success	0
1619906677.422125 NtAllocateVirtualMemory	process_identifier: 3324 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004384 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619906677.468125 CreateProcessInternalW	thread_identifier: 3388 thread_handle: 0x0000845c process_identifier: 3384 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6b1209cba142c72b1743deaa1fe3cbf.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000d960 inherit_handles: 0	success	1
1619906677.468125 NtGetContextThread	thread_handle: 0x0000845c	success	0
1619906677.468125 NtAllocateVirtualMemory	process_identifier: 3384 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000d960 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43605904
FireEye	Generic.mg.c6b1209cba142c72
CAT-QuickHeal	Trojan.MSIL
ALYac	Trojan.GenericKD.43605904
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
Alibaba	Trojan:Win32/Kryptik.6afc2397
K7GW	Trojan ( 0056c20e1 )
Cybereason	malicious.0ed6e2
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZemsilF.34152.Im0@aiyTGzl
F-Prot	W32/MSIL_Kryptik.BIL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Nanocore-9248945-0
GData	Trojan.GenericKD.43605904
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.43605904
ViRobot	Trojan.Win32.Z.Masslogger.561664
Avast	Win32:MalwareX-gen [Trj]
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Trojan.GenericKD.43605904
F-Secure	Trojan.TR/Kryptik.ivlar
TrendMicro	TROJ_GEN.R002C0WH720
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/MSIL_Kryptik.BIL.gen!Eldorado
eGambit	Unsafe.AI_Score_99%
Avira	TR/Kryptik.ivlar
MAX	malware (ai score=83)
Arcabit	Trojan.Generic.D2995F90
AegisLab	Trojan.MSIL.Crypt.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Agensla.R347027
McAfee	Fareit-FXH!C6B1209CBA14
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XGH
TrendMicro-HouseCall	TROJ_GEN.R002C0WH720
Tencent	Msil.Trojan.Crypt.Szuv
Ikarus	Trojan-Spy.MassLogger
Fortinet	MSIL/Kryptik.XGH!tr
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-06 12:19:29

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142 A 172.217.160.110	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.