11.0
0-day
60 个模型检测该样本为恶意！
重新分析
更多

e26473e8992749658b9c141351cc04808187e45a81bd502b259371e2c17d0cb9

d434a51772cc3cc86ff34152c5bba3a6.exe

分析耗时

100s

最近分析

文件大小

1.2MB
静态报毒 动态报毒 AI SCORE=80 AIDETECTVM ALI2000015 AUTO AVSARHER BT8I9P BXXJ CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY EMRT FAREIT GENETIC HIGH CONFIDENCE HOACQX KCLOUD KRYPTIK LOKI MALWARE2 MALWARE@#1IX8WOCGSI0DE OHW@AKQ2DNPI PWSX QNTVW REMCOS SCORE SMAD1 SPYBOTNET STRICTOR TSCOPE UNSAFE X2094 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVZ!D434A51772CC 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (12 个事件)
Time & API Arguments Status Return Repeated
1619915895.440751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff591485
success 0 0
1619915905.049751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb41485
success 0 0
1619915910.503374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5b1485
success 0 0
1619915915.456751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff411485
success 0 0
1619915920.909876
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb71485
success 0 0
1619915929.300124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4b1485
success 0 0
1619915933.207124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff401485
success 0 0
1619915938.003374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff431485
success 0 0
1619915942.815374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd931485
success 0 0
1619915946.721626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff391485
success 0 0
1619915951.878501
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff571485
success 0 0
1619915956.409876
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
sggdhh+0xae3f8 @ 0x4ae3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfde51485
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 378 个事件)
Time & API Arguments Status Return Repeated
1619915892.268374
NtAllocateVirtualMemory
process_identifier: 3044
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619915892.331374
NtProtectVirtualMemory
process_identifier: 3044
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619915892.331374
NtAllocateVirtualMemory
process_identifier: 3044
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02ea0000
success 0 0
1619915893.378751
NtAllocateVirtualMemory
process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619915893.409751
NtProtectVirtualMemory
process_identifier: 2256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619915893.409751
NtAllocateVirtualMemory
process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1619915894.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619915894.362751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f50000
success 0 0
1619915894.362751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f90000
success 0 0
1619915894.362751
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 679936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02040000
success 0 0
1619915894.362751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 655360
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02042000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619915895.331751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619915895.346751
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915894.659751
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619915894.846751
NtProtectVirtualMemory
process_identifier: 2988
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619915894.846751
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00910000
success 0 0
1619915902.284374
NtAllocateVirtualMemory
process_identifier: 3152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619915902.362374
NtProtectVirtualMemory
process_identifier: 3152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619915902.378374
NtAllocateVirtualMemory
process_identifier: 3152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02030000
success 0 0
1619915904.346751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619915904.409751
NtAllocateVirtualMemory
process_identifier: 3228
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619915904.409751
NtAllocateVirtualMemory
process_identifier: 3228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02060000
success 0 0
1619915904.424751
NtAllocateVirtualMemory
process_identifier: 3228
region_size: 679936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619915904.424751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 655360
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005e2000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005e2000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005e2000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005e2000
success 0 0
1619915904.596751
NtProtectVirtualMemory
process_identifier: 3228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 72 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.5786296245869025 section {'size_of_data': '0x000b4800', 'virtual_address': '0x0008a000', 'entropy': 7.5786296245869025, 'name': '.rsrc', 'virtual_size': '0x000b46e0'} description A section with a high entropy has been found
entropy 0.5776 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process sggdhh.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (38 个事件)
Time & API Arguments Status Return Repeated
1619915892.346374
Process32NextW
process_name: d434a51772cc3cc86ff34152c5bba3a6.exe
snapshot_handle: 0x000000f8
process_identifier: 3044
failed 0 0
1619915893.424751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2436
failed 0 0
1619915894.878751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3092
failed 0 0
1619915900.831751
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000194
process_identifier: 2988
failed 0 0
1619915902.456374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3212
failed 0 0
1619915905.081626
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f8
process_identifier: 3384
failed 0 0
1619915907.924626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x0000013c
process_identifier: 3304
failed 0 0
1619915908.721999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3476
failed 0 0
1619915910.737626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3648
failed 0 0
1619915912.846626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000134
process_identifier: 3556
failed 0 0
1619915913.894124
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3724
failed 0 0
1619915915.706499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3892
failed 0 0
1619915918.128499
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x0000014c
process_identifier: 3800
failed 0 0
1619915918.721501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3984
failed 0 0
1619915921.487626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1948
failed 0 0
1619915925.143626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000158
process_identifier: 4060
failed 0 0
1619915926.003501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3288
failed 0 0
1619915929.815626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2968
failed 0 0
1619915931.487626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000128
process_identifier: 3436
failed 0 0
1619915932.018626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x000000f8
process_identifier: 2940
failed 0 0
1619915933.643626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3840
failed 0 0
1619915935.737626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000138
process_identifier: 3716
failed 0 0
1619915936.582249
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3004
failed 0 0
1619915938.628626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1940
failed 0 0
1619915940.549626
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000130
process_identifier: 4020
failed 0 0
1619915941.190876
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1432
failed 0 0
1619915943.299374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3576
failed 0 0
1619915944.362374
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x00000114
process_identifier: 3232
failed 0 0
1619915945.284626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3712
failed 0 0
1619915946.909999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 884
failed 0 0
1619915949.331999
Process32NextW
process_name: sggdhh.exe
snapshot_handle: 0x0000013c
process_identifier: 3848
failed 0 0
1619915950.706751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 4044
failed 0 0
1619915952.268751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 708
failed 0 0
1619915954.221751
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000130
process_identifier: 2812
failed 0 0
1619915954.674999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 284
failed 0 0
1619915957.535249
Process32NextW
process_name: googlecrashhandler64.exe
snapshot_handle: 0x000000f8
process_identifier: 2824
failed 0 0
1619915958.207249
Process32NextW
process_name: GoogleCrashHandler64.exe
snapshot_handle: 0x0000010c
process_identifier: 2824
failed 0 0
1619915959.565999
Process32NextW
process_name: googleupdate.exe
snapshot_handle: 0x000000f8
process_identifier: 2856
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619915892.690374
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3044 created a thread in remote process 2404
Time & API Arguments Status Return Repeated
1619915892.690374
NtQueueApcThread
thread_handle: 0x00000108
process_identifier: 2404
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619915892.690374
WriteProcessMemory
process_identifier: 2404
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619915892.690374
WriteProcessMemory
process_identifier: 2404
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d434a51772cc3cc86ff34152c5bba3a6.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d434a51772cc3cc86ff34152c5bba3a6.exe" winSet mmvjHcwBqVtFtX = CReateObjEct("wsCrIpt.SHelL") MmVjhCWBQVtfTX.RUn """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (24 个事件)
Process injection Process 2256 called NtSetContextThread to modify thread in remote process 2316
Process injection Process 3152 called NtSetContextThread to modify thread in remote process 3228
Process injection Process 3420 called NtSetContextThread to modify thread in remote process 3492
Process injection Process 3668 called NtSetContextThread to modify thread in remote process 3740
Process injection Process 3920 called NtSetContextThread to modify thread in remote process 4000
Process injection Process 2296 called NtSetContextThread to modify thread in remote process 3300
Process injection Process 2940 called NtSetContextThread to modify thread in remote process 3652
Process injection Process 3852 called NtSetContextThread to modify thread in remote process 3944
Process injection Process 3128 called NtSetContextThread to modify thread in remote process 3260
Process injection Process 3608 called NtSetContextThread to modify thread in remote process 3728
Process injection Process 3960 called NtSetContextThread to modify thread in remote process 3872
Process injection Process 3568 called NtSetContextThread to modify thread in remote process 3036
Time & API Arguments Status Return Repeated
1619915893.612751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2316
success 0 0
1619915903.409374
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3228
success 0 0
1619915909.628999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3492
success 0 0
1619915914.644124
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3740
success 0 0
1619915919.784501
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4000
success 0 0
1619915927.612501
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3300
success 0 0
1619915932.674626
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3652
success 0 0
1619915937.160249
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3944
success 0 0
1619915941.924876
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3260
success 0 0
1619915945.893626
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3728
success 0 0
1619915951.143751
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3872
success 0 0
1619915954.956999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3036
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (24 个事件)
Process injection Process 2256 resumed a thread in remote process 2316
Process injection Process 3152 resumed a thread in remote process 3228
Process injection Process 3420 resumed a thread in remote process 3492
Process injection Process 3668 resumed a thread in remote process 3740
Process injection Process 3920 resumed a thread in remote process 4000
Process injection Process 2296 resumed a thread in remote process 3300
Process injection Process 2940 resumed a thread in remote process 3652
Process injection Process 3852 resumed a thread in remote process 3944
Process injection Process 3128 resumed a thread in remote process 3260
Process injection Process 3608 resumed a thread in remote process 3728
Process injection Process 3960 resumed a thread in remote process 3872
Process injection Process 3568 resumed a thread in remote process 3036
Time & API Arguments Status Return Repeated
1619915894.174751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2316
success 0 0
1619915904.174374
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3228
success 0 0
1619915910.159999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3492
success 0 0
1619915915.160124
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3740
success 0 0
1619915920.612501
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 4000
success 0 0
1619915928.721501
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3300
success 0 0
1619915932.909626
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3652
success 0 0
1619915937.675249
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3944
success 0 0
1619915942.440876
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3260
success 0 0
1619915946.362626
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3728
success 0 0
1619915951.456751
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 3872
success 0 0
1619915955.503999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3036
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 102 个事件)
Time & API Arguments Status Return Repeated
1619915892.690374
CreateProcessInternalW
thread_identifier: 884
thread_handle: 0x00000108
process_identifier: 2404
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915892.690374
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619915892.690374
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619915892.690374
WriteProcessMemory
process_identifier: 2404
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619915892.690374
WriteProcessMemory
process_identifier: 2404
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d434a51772cc3cc86ff34152c5bba3a6.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d434a51772cc3cc86ff34152c5bba3a6.exe" winSet mmvjHcwBqVtFtX = CReateObjEct("wsCrIpt.SHelL") MmVjhCWBQVtfTX.RUn """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619915893.160249
CreateProcessInternalW
thread_identifier: 2116
thread_handle: 0x000000d0
process_identifier: 2256
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619915893.581751
CreateProcessInternalW
thread_identifier: 340
thread_handle: 0x00000108
process_identifier: 2316
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915893.581751
NtUnmapViewOfSection
process_identifier: 2316
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915893.596751
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2316
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915893.612751
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619915893.612751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2316
success 0 0
1619915894.174751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2316
success 0 0
1619915894.253751
CreateProcessInternalW
thread_identifier: 2764
thread_handle: 0x0000010c
process_identifier: 2988
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe" 2 2316 28889796
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619915901.924751
CreateProcessInternalW
thread_identifier: 3156
thread_handle: 0x00000198
process_identifier: 3152
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000019c
inherit_handles: 0
success 1 0
1619915903.221374
CreateProcessInternalW
thread_identifier: 3232
thread_handle: 0x00000108
process_identifier: 3228
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915903.221374
NtUnmapViewOfSection
process_identifier: 3228
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915903.253374
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3228
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915903.409374
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619915903.409374
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3228
success 0 0
1619915904.174374
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3228
success 0 0
1619915904.284374
CreateProcessInternalW
thread_identifier: 3308
thread_handle: 0x0000010c
process_identifier: 3304
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe" 2 3228 28899796
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619915908.159626
CreateProcessInternalW
thread_identifier: 3424
thread_handle: 0x00000140
process_identifier: 3420
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000144
inherit_handles: 0
success 1 0
1619915909.393999
CreateProcessInternalW
thread_identifier: 3496
thread_handle: 0x00000108
process_identifier: 3492
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915909.393999
NtUnmapViewOfSection
process_identifier: 3492
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915909.393999
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3492
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915909.628999
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619915909.628999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3492
success 0 0
1619915910.159999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3492
success 0 0
1619915910.331999
CreateProcessInternalW
thread_identifier: 3560
thread_handle: 0x0000010c
process_identifier: 3556
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe" 2 3492 28905796
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619915913.253626
CreateProcessInternalW
thread_identifier: 3672
thread_handle: 0x00000138
process_identifier: 3668
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000013c
inherit_handles: 0
success 1 0
1619915914.519124
CreateProcessInternalW
thread_identifier: 3744
thread_handle: 0x00000108
process_identifier: 3740
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915914.519124
NtUnmapViewOfSection
process_identifier: 3740
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915914.535124
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3740
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915914.644124
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619915914.644124
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3740
success 0 0
1619915915.160124
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3740
success 0 0
1619915915.347124
CreateProcessInternalW
thread_identifier: 3804
thread_handle: 0x0000010c
process_identifier: 3800
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe" 2 3740 28910781
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619915918.253499
CreateProcessInternalW
thread_identifier: 3924
thread_handle: 0x00000150
process_identifier: 3920
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000154
inherit_handles: 0
success 1 0
1619915919.643501
CreateProcessInternalW
thread_identifier: 4004
thread_handle: 0x00000108
process_identifier: 4000
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915919.643501
NtUnmapViewOfSection
process_identifier: 4000
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915919.690501
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 4000
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915919.784501
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619915919.784501
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644368
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4000
success 0 0
1619915920.612501
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 4000
success 0 0
1619915920.768501
CreateProcessInternalW
thread_identifier: 4064
thread_handle: 0x0000010c
process_identifier: 4060
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe" 2 4000 28916234
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619915925.346626
CreateProcessInternalW
thread_identifier: 3272
thread_handle: 0x0000015c
process_identifier: 2296
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000160
inherit_handles: 0
success 1 0
1619915927.346501
CreateProcessInternalW
thread_identifier: 3264
thread_handle: 0x00000108
process_identifier: 3300
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\sggdhh.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619915927.346501
NtUnmapViewOfSection
process_identifier: 3300
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619915927.346501
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3300
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619915927.612501
NtGetContextThread
thread_handle: 0x00000108
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.309804
FireEye Generic.mg.d434a51772cc3cc8
McAfee Fareit-FVZ!D434A51772CC
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2257361
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Gen:Variant.Zusy.309804
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Zusy.D4BA2C
Cyren W32/Injector.BXXJ-4480
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Malware.Remcos-8987122-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Kryptik.hoacqx
AegisLab Trojan.Win32.Strictor.4!c
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Gen:Variant.Zusy.309804
Emsisoft Gen:Variant.Zusy.309804 (B)
Comodo Malware@#1ix8wocgsi0de
F-Secure Trojan.TR/Injector.qntvw
DrWeb BackDoor.SpyBotNET.25
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Sophos Mal/Generic-S
Ikarus Trojan.Inject
Jiangmin Trojan.Kryptik.bwy
Avira TR/Injector.qntvw
MAX malware (ai score=80)
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Gen:Variant.Zusy.309804
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.oHW@aKq2dNpi
ALYac Gen:Variant.Zusy.309804
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Panda Trj/Genetic.gen
Zoner Trojan.Win32.94576
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d164 VirtualFree
• 0x47d168 VirtualAlloc
• 0x47d16c LocalFree
• 0x47d170 LocalAlloc
• 0x47d174 GetVersion
• 0x47d178 GetCurrentThreadId
• 0x47d184 VirtualQuery
• 0x47d188 WideCharToMultiByte
• 0x47d18c MultiByteToWideChar
• 0x47d190 lstrlenA
• 0x47d194 lstrcpynA
• 0x47d198 LoadLibraryExA
• 0x47d19c GetThreadLocale
• 0x47d1a0 GetStartupInfoA
• 0x47d1a4 GetProcAddress
• 0x47d1a8 GetModuleHandleA
• 0x47d1ac GetModuleFileNameA
• 0x47d1b0 GetLocaleInfoA
• 0x47d1b4 GetCommandLineA
• 0x47d1b8 FreeLibrary
• 0x47d1bc FindFirstFileA
• 0x47d1c0 FindClose
• 0x47d1c4 ExitProcess
• 0x47d1c8 WriteFile
• 0x47d1d0 RtlUnwind
• 0x47d1d4 RaiseException
• 0x47d1d8 GetStdHandle
Library user32.dll:
• 0x47d1e0 GetKeyboardType
• 0x47d1e4 LoadStringA
• 0x47d1e8 MessageBoxA
• 0x47d1ec CharNextA
Library advapi32.dll:
• 0x47d1f4 RegQueryValueExA
• 0x47d1f8 RegOpenKeyExA
• 0x47d1fc RegCloseKey
Library oleaut32.dll:
• 0x47d204 SysFreeString
• 0x47d208 SysReAllocStringLen
• 0x47d20c SysAllocStringLen
Library kernel32.dll:
• 0x47d214 TlsSetValue
• 0x47d218 TlsGetValue
• 0x47d21c LocalAlloc
• 0x47d220 GetModuleHandleA
Library advapi32.dll:
• 0x47d228 RegQueryValueExA
• 0x47d22c RegOpenKeyExA
• 0x47d230 RegCloseKey
Library kernel32.dll:
• 0x47d238 lstrcpyA
• 0x47d23c WriteFile
• 0x47d240 WaitForSingleObject
• 0x47d244 VirtualQuery
• 0x47d248 VirtualProtect
• 0x47d24c VirtualAlloc
• 0x47d250 Sleep
• 0x47d254 SizeofResource
• 0x47d258 SetThreadLocale
• 0x47d25c SetFilePointer
• 0x47d260 SetEvent
• 0x47d264 SetErrorMode
• 0x47d268 SetEndOfFile
• 0x47d26c ResetEvent
• 0x47d270 ReadFile
• 0x47d274 MultiByteToWideChar
• 0x47d278 MulDiv
• 0x47d27c LockResource
• 0x47d280 LoadResource
• 0x47d284 LoadLibraryA
• 0x47d290 GlobalUnlock
• 0x47d294 GlobalReAlloc
• 0x47d298 GlobalHandle
• 0x47d29c GlobalLock
• 0x47d2a0 GlobalFree
• 0x47d2a4 GlobalFindAtomA
• 0x47d2a8 GlobalDeleteAtom
• 0x47d2ac GlobalAlloc
• 0x47d2b0 GlobalAddAtomA
• 0x47d2b4 GetVersionExA
• 0x47d2b8 GetVersion
• 0x47d2bc GetTickCount
• 0x47d2c0 GetThreadLocale
• 0x47d2c4 GetSystemInfo
• 0x47d2c8 GetStringTypeExA
• 0x47d2cc GetStdHandle
• 0x47d2d0 GetProcAddress
• 0x47d2d4 GetModuleHandleA
• 0x47d2d8 GetModuleFileNameA
• 0x47d2dc GetLocaleInfoA
• 0x47d2e0 GetLocalTime
• 0x47d2e4 GetLastError
• 0x47d2e8 GetFullPathNameA
• 0x47d2ec GetFileAttributesA
• 0x47d2f0 GetDiskFreeSpaceA
• 0x47d2f4 GetDateFormatA
• 0x47d2f8 GetCurrentThreadId
• 0x47d2fc GetCurrentProcessId
• 0x47d300 GetCPInfo
• 0x47d304 GetACP
• 0x47d308 FreeResource
• 0x47d310 InterlockedExchange
• 0x47d318 FreeLibrary
• 0x47d31c FormatMessageA
• 0x47d320 FindResourceA
• 0x47d324 FindFirstFileA
• 0x47d328 FindClose
• 0x47d334 EnumCalendarInfoA
• 0x47d340 CreateThread
• 0x47d344 CreateFileA
• 0x47d348 CreateEventA
• 0x47d34c CompareStringA
• 0x47d350 CloseHandle
Library version.dll:
• 0x47d358 VerQueryValueA
• 0x47d360 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d368 UnrealizeObject
• 0x47d36c StretchBlt
• 0x47d370 SetWindowOrgEx
• 0x47d374 SetWinMetaFileBits
• 0x47d378 SetViewportOrgEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetEnhMetaFileBits
• 0x47d390 SetDIBColorTable
• 0x47d394 SetBrushOrgEx
• 0x47d398 SetBkMode
• 0x47d39c SetBkColor
• 0x47d3a0 SelectPalette
• 0x47d3a4 SelectObject
• 0x47d3a8 SaveDC
• 0x47d3ac RestoreDC
• 0x47d3b0 Rectangle
• 0x47d3b4 RectVisible
• 0x47d3b8 RealizePalette
• 0x47d3bc Polyline
• 0x47d3c0 PlayEnhMetaFile
• 0x47d3c4 PatBlt
• 0x47d3c8 MoveToEx
• 0x47d3cc MaskBlt
• 0x47d3d0 LineTo
• 0x47d3d4 IntersectClipRect
• 0x47d3d8 GetWindowOrgEx
• 0x47d3dc GetWinMetaFileBits
• 0x47d3e0 GetTextMetricsA
• 0x47d3ec GetStockObject
• 0x47d3f0 GetPixel
• 0x47d3f4 GetPaletteEntries
• 0x47d3f8 GetObjectA
• 0x47d404 GetEnhMetaFileBits
• 0x47d408 GetDeviceCaps
• 0x47d40c GetDIBits
• 0x47d410 GetDIBColorTable
• 0x47d414 GetDCOrgEx
• 0x47d41c GetClipBox
• 0x47d420 GetBrushOrgEx
• 0x47d424 GetBitmapBits
• 0x47d428 ExcludeClipRect
• 0x47d42c DeleteObject
• 0x47d430 DeleteEnhMetaFile
• 0x47d434 DeleteDC
• 0x47d438 CreateSolidBrush
• 0x47d43c CreatePenIndirect
• 0x47d440 CreatePalette
• 0x47d448 CreateFontIndirectA
• 0x47d44c CreateDIBitmap
• 0x47d450 CreateDIBSection
• 0x47d454 CreateCompatibleDC
• 0x47d45c CreateBrushIndirect
• 0x47d460 CreateBitmap
• 0x47d464 CopyEnhMetaFileA
• 0x47d468 BitBlt
Library user32.dll:
• 0x47d470 CreateWindowExA
• 0x47d474 WindowFromPoint
• 0x47d478 WinHelpA
• 0x47d47c WaitMessage
• 0x47d480 UpdateWindow
• 0x47d484 UnregisterClassA
• 0x47d488 UnhookWindowsHookEx
• 0x47d48c TranslateMessage
• 0x47d494 TrackPopupMenu
• 0x47d49c ShowWindow
• 0x47d4a0 ShowScrollBar
• 0x47d4a4 ShowOwnedPopups
• 0x47d4a8 ShowCursor
• 0x47d4ac SetWindowsHookExA
• 0x47d4b0 SetWindowPos
• 0x47d4b4 SetWindowPlacement
• 0x47d4b8 SetWindowLongA
• 0x47d4bc SetTimer
• 0x47d4c0 SetScrollRange
• 0x47d4c4 SetScrollPos
• 0x47d4c8 SetScrollInfo
• 0x47d4cc SetRect
• 0x47d4d0 SetPropA
• 0x47d4d4 SetParent
• 0x47d4d8 SetMenuItemInfoA
• 0x47d4dc SetMenu
• 0x47d4e0 SetForegroundWindow
• 0x47d4e4 SetFocus
• 0x47d4e8 SetCursor
• 0x47d4ec SetClassLongA
• 0x47d4f0 SetCapture
• 0x47d4f4 SetActiveWindow
• 0x47d4f8 SendMessageA
• 0x47d4fc ScrollWindow
• 0x47d500 ScreenToClient
• 0x47d504 RemovePropA
• 0x47d508 RemoveMenu
• 0x47d50c ReleaseDC
• 0x47d510 ReleaseCapture
• 0x47d51c RegisterClassA
• 0x47d520 RedrawWindow
• 0x47d524 PtInRect
• 0x47d528 PostQuitMessage
• 0x47d52c PostMessageA
• 0x47d530 PeekMessageA
• 0x47d534 OffsetRect
• 0x47d538 OemToCharA
• 0x47d53c MessageBoxA
• 0x47d540 MapWindowPoints
• 0x47d544 MapVirtualKeyA
• 0x47d548 LoadStringA
• 0x47d54c LoadKeyboardLayoutA
• 0x47d550 LoadIconA
• 0x47d554 LoadCursorA
• 0x47d558 LoadBitmapA
• 0x47d55c KillTimer
• 0x47d560 IsZoomed
• 0x47d564 IsWindowVisible
• 0x47d568 IsWindowEnabled
• 0x47d56c IsWindow
• 0x47d570 IsRectEmpty
• 0x47d574 IsIconic
• 0x47d578 IsDialogMessageA
• 0x47d57c IsChild
• 0x47d580 InvalidateRect
• 0x47d584 IntersectRect
• 0x47d588 InsertMenuItemA
• 0x47d58c InsertMenuA
• 0x47d590 InflateRect
• 0x47d598 GetWindowTextA
• 0x47d59c GetWindowRect
• 0x47d5a0 GetWindowPlacement
• 0x47d5a4 GetWindowLongA
• 0x47d5a8 GetWindowDC
• 0x47d5ac GetTopWindow
• 0x47d5b0 GetSystemMetrics
• 0x47d5b4 GetSystemMenu
• 0x47d5b8 GetSysColorBrush
• 0x47d5bc GetSysColor
• 0x47d5c0 GetSubMenu
• 0x47d5c4 GetScrollRange
• 0x47d5c8 GetScrollPos
• 0x47d5cc GetScrollInfo
• 0x47d5d0 GetPropA
• 0x47d5d4 GetParent
• 0x47d5d8 GetWindow
• 0x47d5dc GetMenuStringA
• 0x47d5e0 GetMenuState
• 0x47d5e4 GetMenuItemInfoA
• 0x47d5e8 GetMenuItemID
• 0x47d5ec GetMenuItemCount
• 0x47d5f0 GetMenu
• 0x47d5f4 GetLastActivePopup
• 0x47d5f8 GetKeyboardState
• 0x47d600 GetKeyboardLayout
• 0x47d604 GetKeyState
• 0x47d608 GetKeyNameTextA
• 0x47d60c GetIconInfo
• 0x47d610 GetForegroundWindow
• 0x47d614 GetFocus
• 0x47d618 GetDlgItem
• 0x47d61c GetDesktopWindow
• 0x47d620 GetDCEx
• 0x47d624 GetDC
• 0x47d628 GetCursorPos
• 0x47d62c GetCursor
• 0x47d630 GetClipboardData
• 0x47d634 GetClientRect
• 0x47d638 GetClassNameA
• 0x47d63c GetClassInfoA
• 0x47d640 GetCapture
• 0x47d644 GetActiveWindow
• 0x47d648 FrameRect
• 0x47d64c FindWindowA
• 0x47d650 FillRect
• 0x47d654 EqualRect
• 0x47d658 EnumWindows
• 0x47d65c EnumThreadWindows
• 0x47d660 EndPaint
• 0x47d664 EnableWindow
• 0x47d668 EnableScrollBar
• 0x47d66c EnableMenuItem
• 0x47d670 DrawTextA
• 0x47d674 DrawMenuBar
• 0x47d678 DrawIconEx
• 0x47d67c DrawIcon
• 0x47d680 DrawFrameControl
• 0x47d684 DrawEdge
• 0x47d688 DispatchMessageA
• 0x47d68c DestroyWindow
• 0x47d690 DestroyMenu
• 0x47d694 DestroyIcon
• 0x47d698 DestroyCursor
• 0x47d69c DeleteMenu
• 0x47d6a0 DefWindowProcA
• 0x47d6a4 DefMDIChildProcA
• 0x47d6a8 DefFrameProcA
• 0x47d6ac CreatePopupMenu
• 0x47d6b0 CreateMenu
• 0x47d6b4 CreateIcon
• 0x47d6b8 ClientToScreen
• 0x47d6bc CheckMenuItem
• 0x47d6c0 CallWindowProcA
• 0x47d6c4 CallNextHookEx
• 0x47d6c8 BeginPaint
• 0x47d6cc CharNextA
• 0x47d6d0 CharLowerBuffA
• 0x47d6d4 CharLowerA
• 0x47d6d8 CharToOemA
• 0x47d6dc AdjustWindowRectEx
Library kernel32.dll:
• 0x47d6e8 Sleep
Library oleaut32.dll:
• 0x47d6f0 SafeArrayPtrOfIndex
• 0x47d6f4 SafeArrayGetUBound
• 0x47d6f8 SafeArrayGetLBound
• 0x47d6fc SafeArrayCreate
• 0x47d700 VariantChangeType
• 0x47d704 VariantCopy
• 0x47d708 VariantClear
• 0x47d70c VariantInit
Library ole32.dll:
• 0x47d714 CoCreateInstance
• 0x47d718 CoUninitialize
• 0x47d71c CoInitialize
Library oleaut32.dll:
• 0x47d724 CreateErrorInfo
• 0x47d728 GetErrorInfo
• 0x47d72c SetErrorInfo
• 0x47d730 SysFreeString
Library comctl32.dll:
• 0x47d740 ImageList_Write
• 0x47d744 ImageList_Read
• 0x47d754 ImageList_DragMove
• 0x47d758 ImageList_DragLeave
• 0x47d75c ImageList_DragEnter
• 0x47d760 ImageList_EndDrag
• 0x47d764 ImageList_BeginDrag
• 0x47d768 ImageList_Remove
• 0x47d76c ImageList_DrawEx
• 0x47d770 ImageList_Replace
• 0x47d774 ImageList_Draw
• 0x47d784 ImageList_Add
• 0x47d78c ImageList_Destroy
• 0x47d790 ImageList_Create
Library comdlg32.dll:
• 0x47d798 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.