SmartHawk

15.0

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

3b0c8c8ac8b8f8a63b32aa842e34a31351b0950243854360bd34306d3790a470

d542141f5e8cff74364315499d0c6b09.exe

分析耗时

107s

最近分析

文件大小

783.0KB

静态报毒动态报毒 AGENSLA AGENTTESLA AI SCORE=89 AJXNC ALI1000139 ANDROMEDA ATTRIBUTE AVSARHER BUBVUR CLASSIC CONFIDENCE ELDORADO FAKEXLS@CV FAREIT GENERICKD HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HURPXZ KRYPTIK MALICIOUS PE NANOCORE PWSX QQPASS QQROB R002C0PI720 SCORE SOCELARSTAE STARTER TROJANPWS UNSAFE WM0@AGE WPSS YMACCO ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/starter.ali1000139	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20200923	18.4.3895.0
Kingsoft		20200923	2013.8.14.323
McAfee	Fareit-FZL!D542141F5E8C	20200922	6.0.6.653
Tencent	Msil.Trojan-qqpass.Qqrob.Wpss	20200923	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620916851.893751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620916859.737626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620916862.065626 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916796.502876 IsDebuggerPresent		failed	0	0
1620916796.502876 IsDebuggerPresent		failed	0	0
1620916854.955751 IsDebuggerPresent		failed	0	0
1620916854.955751 IsDebuggerPresent		failed	0	0

Command line console output was observed (3 个事件)

Time & API	Arguments	Status	Return
1620916852.440751 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\bJndYFgryrJkt"。 console_handle: 0x00000007	success	1
1620916860.080626 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service"。 console_handle: 0x00000007	success	1
1620916862.830626 WriteConsoleW	buffer: 成功: 成功创建计划任务 "DSL Service Task"。 console_handle: 0x00000007	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916796.518876 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Connects to a Dynamic DNS Domain (1 个事件)

domain

johnie3m.hopto.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 167 个事件)

Time & API	Arguments	Status
1620916795.924876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00930000	success
1620916795.924876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ab0000	success
1620916796.143876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005c0000	success
1620916796.143876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d0000	success
1620916796.330876 NtProtectVirtualMemory	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1620916796.502876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006a0000	success
1620916796.502876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006a0000	success
1620916796.502876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0063a000	success
1620916796.518876 NtProtectVirtualMemory	process_identifier: 2196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1620916796.518876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00632000	success
1620916796.799876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00652000	success
1620916797.065876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00675000	success
1620916797.080876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0067b000	success
1620916797.080876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00677000	success
1620916797.284876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00653000	success
1620916797.409876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0065c000	success
1620916797.580876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a80000	success
1620916797.643876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00654000	success
1620916797.643876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a81000	success
1620916797.659876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a82000	success
1620916797.659876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a83000	success
1620916797.768876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a84000	success
1620916797.784876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a85000	success
1620916798.049876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00655000	success
1620916798.065876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00656000	success
1620916798.393876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00657000	success
1620916798.424876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00659000	success
1620916798.830876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0066a000	success
1620916798.830876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00667000	success
1620916798.940876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success
1620916798.940876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a91000	success
1620916799.065876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a86000	success
1620916799.080876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00666000	success
1620916799.159876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a92000	success
1620916799.205876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a93000	success
1620916799.205876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a94000	success
1620916799.205876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0065d000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef48000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef30000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef30000	success
1620916799.237876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a95000	success
1620916799.252876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a87000	success
1620916799.268876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a96000	success
1620916799.346876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a88000	success
1620916799.362876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a89000	success
1620916799.830876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0065a000	success
1620916800.034876 NtAllocateVirtualMemory	process_identifier: 2196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0066b000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (4 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp557A.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp"
cmdline	schtasks.exe /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4BF3.tmp"

A process created a hidden window (3 个事件)

Time & API	Arguments	Status	Return
1620916851.643876 ShellExecuteExW	parameters: /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1
1620916859.159751 CreateProcessInternalW	thread_identifier: 2412 thread_handle: 0x00000258 process_identifier: 3044 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4BF3.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000260 inherit_handles: 1	success	1
1620916861.534751 CreateProcessInternalW	thread_identifier: 1752 thread_handle: 0x00000258 process_identifier: 1416 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp557A.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000290 inherit_handles: 1	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.355633604387823

section

{'size_of_data': '0x000c1400', 'virtual_address': '0x00002000', 'entropy': 7.355633604387823, 'name': '.text', 'virtual_size': '0x000c1214'}

description

A section with a high entropy has been found

entropy

0.9878594249201278

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916864.752751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (4 个事件)

cmdline	"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp557A.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp"
cmdline	schtasks.exe /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp"
cmdline	"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4BF3.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (2 个事件)

host	13.227.250.204
host	172.217.24.14

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916854.315876 NtAllocateVirtualMemory	process_identifier: 952 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916865.237751 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

d542141f5e8cff74364315499d0c6b09.exe tried to sleep 5456444 seconds, actually delayed analysis time by 5456444 seconds

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service

reg_value

C:\Program Files (x86)\DSL Service\dslsvc.exe

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1620916854.315876 WriteProcessMemory	process_identifier: 952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ process_handle: 0x000003a0 base_address: 0x00400000	success	1
1620916854.330876 WriteProcessMemory	process_identifier: 952 buffer: à7 process_handle: 0x000003a0 base_address: 0x00420000	success	1
1620916854.330876 WriteProcessMemory	process_identifier: 952 buffer: @ process_handle: 0x000003a0 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620916854.315876 WriteProcessMemory	process_identifier: 952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ process_handle: 0x000003a0 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2196 called NtSetContextThread to modify thread in remote process 952
1620916854.330876 NtSetContextThread	thread_handle: 0x0000037c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 952	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d542141f5e8cff74364315499d0c6b09.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2196 resumed a thread in remote process 952
1620916854.690876 NtResumeThread	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 952	success	0	0

Executed a process and injected code into it, probably while unpacking (30 个事件)

Time & API	Arguments	Status	Return
1620916796.502876 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2196	success	0
1620916796.518876 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2196	success	0
1620916796.534876 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2196	success	0
1620916851.627876 CreateProcessInternalW	thread_identifier: 2960 thread_handle: 0x00000374 process_identifier: 2948 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bJndYFgryrJkt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2D9E.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000390 inherit_handles: 0	success	1
1620916854.315876 CreateProcessInternalW	thread_identifier: 2516 thread_handle: 0x0000037c process_identifier: 952 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d542141f5e8cff74364315499d0c6b09.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d542141f5e8cff74364315499d0c6b09.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003a0 inherit_handles: 0	success	1
1620916854.315876 NtGetContextThread	thread_handle: 0x0000037c	success	0
1620916854.315876 NtAllocateVirtualMemory	process_identifier: 952 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1620916854.315876 WriteProcessMemory	process_identifier: 952 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈbç @ 8çW Ø_ H.textÇ È `.relocÊ@B.rsrcØ_ `Ì@@ process_handle: 0x000003a0 base_address: 0x00400000	success	1
1620916854.315876 WriteProcessMemory	process_identifier: 952 buffer: process_handle: 0x000003a0 base_address: 0x00402000	success	1
1620916854.330876 WriteProcessMemory	process_identifier: 952 buffer: à7 process_handle: 0x000003a0 base_address: 0x00420000	success	1
1620916854.330876 WriteProcessMemory	process_identifier: 952 buffer: process_handle: 0x000003a0 base_address: 0x00422000	success	1
1620916854.330876 WriteProcessMemory	process_identifier: 952 buffer: @ process_handle: 0x000003a0 base_address: 0x7efde008	success	1
1620916854.330876 NtSetContextThread	thread_handle: 0x0000037c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 952	success	0
1620916854.690876 NtResumeThread	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 952	success	0
1620916854.690876 NtResumeThread	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 2196	success	0
1620916854.705876 NtGetContextThread	thread_handle: 0x000003b4	success	0
1620916854.705876 NtGetContextThread	thread_handle: 0x000003b4	success	0
1620916854.705876 NtResumeThread	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 2196	success	0
1620916854.955751 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 952	success	0
1620916854.971751 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 952	success	0
1620916855.096751 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 952	success	0
1620916859.159751 CreateProcessInternalW	thread_identifier: 2412 thread_handle: 0x00000258 process_identifier: 3044 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp4BF3.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000260 inherit_handles: 1	success	1
1620916861.534751 CreateProcessInternalW	thread_identifier: 1752 thread_handle: 0x00000258 process_identifier: 1416 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp557A.tmp" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000290 inherit_handles: 1	success	1
1620916864.549751 NtResumeThread	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 952	success	0
1620916864.580751 NtResumeThread	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 952	success	0
1620916864.627751 NtResumeThread	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 952	success	0
1620916865.112751 NtResumeThread	thread_handle: 0x0000030c suspend_count: 1 process_identifier: 952	success	0
1620916867.549751 NtResumeThread	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 952	success	0
1620916869.940751 NtResumeThread	thread_handle: 0x00000390 suspend_count: 1 process_identifier: 952	success	0
1620916870.705751 NtResumeThread	thread_handle: 0x000003ac suspend_count: 1 process_identifier: 952	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Bkav	W32.SocelarsTAE.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43782922
FireEye	Generic.mg.d542141f5e8cff74
CAT-QuickHeal	Trojanpws.Msil
ALYac	Trojan.GenericKD.43782922
Cylance	Unsafe
Zillya	Trojan.Agensla.Win32.5914
Sangfor	Malware
K7AntiVirus	Trojan ( 0056dbf01 )
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 0056dbf01 )
Cybereason	malicious.f5e8cf
Arcabit	Trojan.Generic.D29C130A
Invincea	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34254.Wm0@aGE!yAg
Cyren	W32/MSIL_Kryptik.BOC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.43782922
NANO-Antivirus	Trojan.Win32.Agensla.hurpxz
ViRobot	Trojan.Win32.Z.Kryptik.801792.N
SUPERAntiSpyware	Backdoor.Andromeda/Variant
Avast	Win32:PWSX-gen [Trj]
Rising	Malware.FakeXLS@CV!1.9C3D (CLASSIC)
Ad-Aware	Trojan.GenericKD.43782922
Emsisoft	Trojan.GenericKD.43782922 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PI720
McAfee-GW-Edition	Fareit-FZL!D542141F5E8C
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Trojan.Gen
Avira	TR/AD.Nanocore.ajxnc
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:Win32/Ymacco.AB3B
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.43782922
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.RL_Generic.C4192546
McAfee	Fareit-FZL!D542141F5E8C
MAX	malware (ai score=89)
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Spyware.AgentTesla
ESET-NOD32	a variant of MSIL/Kryptik.XPD
TrendMicro-HouseCall	TROJ_GEN.R002C0PI720
Tencent	Msil.Trojan-qqpass.Qqrob.Wpss

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	192.168.56.101:49189
dead_host	192.168.56.101:49194
dead_host	79.134.225.124:9497
dead_host	192.168.56.101:49180
dead_host	13.227.250.204:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-04 06:30:36

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
johnie3m.hopto.org	A 79.134.225.124	79.134.225.124
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	51378	8.8.8.8	53
192.168.56.101	51808	8.8.8.8	53
192.168.56.101	53657	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.