5.6
高危
57 个模型检测该样本为恶意！
重新分析
更多

40a4f7184aee555b871823a677a8ac7278856f735f8fd0080322f8c67e8be4f2

e5607c54c026676782b24856d4214d58.exe

分析耗时

103s

最近分析

文件大小

2.0MB
静态报毒 动态报毒 100% 9R0@A8TRQSLI AI SCORE=89 AIDETECTVM ANDROM AUWH BANKERX BSCOPE CLASSIC CONFIDENCE ELDORADO EMOTET ENCPK FTCHP GENCIRC GENETIC HDMT HDSI HIGH CONFIDENCE HJLUMC INJECT3 IRAFFUZUXCW KRYPTIK MALICIOUS PE MALWARE2 MALWARE@#2Y53GEXWNV8CR MINT PINKSBOT QAKBOT QBOT QVM20 R + MAL R335010 REGOTET SCORE SHADE STATIC AI TROJANBANKER UNSAFE ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanBanker:Win32/Kryptik.c88be314 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20201228 21.1.5827.0
Tencent Malware.Win32.Gencirc.10b9ebb7 20201228 1.0.0.1
Kingsoft 20201228 2017.9.26.565
McAfee W32/PinkSbot-GN!E5607C54C026 20201228 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619955951.664375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619955992.304375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619955977.414375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
One or more processes crashed (4 个事件)
Time & API Arguments Status Return Repeated
1619955992.304375
__exception__
stacktrace: 
RtlConvertSidToUnicodeString+0x28 RtlFormatCurrentUserKeyPath-0x257 ntdll+0x3aeea @ 0x77d6aeea
ConvertSidToStringSidW+0x24 CopySid-0xe6 advapi32+0x14368 @ 0x76554368
e5607c54c026676782b24856d4214d58+0xa5b6 @ 0x40a5b6
e5607c54c026676782b24856d4214d58+0x8853 @ 0x408853
e5607c54c026676782b24856d4214d58+0x8451 @ 0x408451
e5607c54c026676782b24856d4214d58+0x8ec9 @ 0x408ec9
e5607c54c026676782b24856d4214d58+0x17cc @ 0x4017cc
e5607c54c026676782b24856d4214d58+0x1c66 @ 0x401c66
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1632744
registers.edi: 0
registers.eax: 2860
registers.ebp: 1632784
registers.edx: 2
registers.ebx: 1
registers.esi: 2860
registers.ecx: 2860
exception.instruction_r: 8a 08 80 e1 0f 80 f9 01 75 24 8a 48 01 80 f9 0f
exception.symbol: RtlValidSid+0x17 RtlCopySid-0x3e ntdll+0x392a9
exception.instruction: mov cl, byte ptr [eax]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 234153
exception.address: 0x77d692a9
success 0 0
1619955992.742375
__exception__
stacktrace: 
EqualSid+0x19 EqualPrefixSid-0xc kernelbase+0x1bfe3 @ 0x778fbfe3
e5607c54c026676782b24856d4214d58+0x84c8 @ 0x4084c8
e5607c54c026676782b24856d4214d58+0xa27c @ 0x40a27c
e5607c54c026676782b24856d4214d58+0xa2b7 @ 0x40a2b7
e5607c54c026676782b24856d4214d58+0x8f66 @ 0x408f66
e5607c54c026676782b24856d4214d58+0x17cc @ 0x4017cc
e5607c54c026676782b24856d4214d58+0x1c66 @ 0x401c66
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634132
registers.edi: 2860
registers.eax: 1281
registers.ebp: 1634140
registers.edx: 0
registers.ebx: 40565000
registers.esi: 40565000
registers.ecx: 2130563072
exception.instruction_r: 66 3b 07 0f 85 e1 ef ff ff 0f b6 4e 01 33 c0 8d
exception.symbol: RtlEqualSid+0x10 RtlSetCriticalSectionSpinCount-0x26 ntdll+0x394c1
exception.instruction: cmp ax, word ptr [edi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 234689
exception.address: 0x77d694c1
success 0 0
1619955978.133375
__exception__
stacktrace: 
e5607c54c026676782b24856d4214d58+0x3daa @ 0x403daa
e5607c54c026676782b24856d4214d58+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 2769648
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: e5607c54c026676782b24856d4214d58+0x33cc
exception.instruction: in eax, dx
exception.module: e5607c54c026676782b24856d4214d58.exe
exception.exception_code: 0xc0000096
exception.offset: 13260
exception.address: 0x4033cc
success 0 0
1619955978.133375
__exception__
stacktrace: 
e5607c54c026676782b24856d4214d58+0x3db3 @ 0x403db3
e5607c54c026676782b24856d4214d58+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637628
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 2769648
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: e5607c54c026676782b24856d4214d58+0x3465
exception.instruction: in eax, dx
exception.module: e5607c54c026676782b24856d4214d58.exe
exception.exception_code: 0xc0000096
exception.offset: 13413
exception.address: 0x403465
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619955924.273375
NtAllocateVirtualMemory
process_identifier: 912
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619955951.523375
NtAllocateVirtualMemory
process_identifier: 912
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006e0000
success 0 0
1619955951.523375
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619955952.445375
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01dd0000
success 0 0
1619955977.414375
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619955977.414375
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619955952.304375
CreateProcessInternalW
thread_identifier: 2448
thread_handle: 0x00000154
process_identifier: 2616
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e5607c54c026676782b24856d4214d58.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000158
inherit_handles: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 个事件)
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619955978.133375
__exception__
stacktrace: 
e5607c54c026676782b24856d4214d58+0x3daa @ 0x403daa
e5607c54c026676782b24856d4214d58+0x1b23 @ 0x401b23
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637624
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637684
registers.edx: 22104
registers.ebx: 1
registers.esi: 2769648
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: e5607c54c026676782b24856d4214d58+0x33cc
exception.instruction: in eax, dx
exception.module: e5607c54c026676782b24856d4214d58.exe
exception.exception_code: 0xc0000096
exception.offset: 13260
exception.address: 0x4033cc
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Heur.Mint.Regotet.1
FireEye Generic.mg.e5607c54c0266767
CAT-QuickHeal Trojan.Emotet
ALYac Gen:Heur.Mint.Regotet.1
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 005652be1 )
Alibaba TrojanBanker:Win32/Kryptik.c88be314
K7GW Trojan ( 005652be1 )
Cybereason malicious.4c0266
Arcabit Trojan.Mint.Regotet.1
Cyren W32/Kryptik.BMJ.gen!Eldorado
Symantec Packed.Generic.459
APEX Malicious
Avast Win32:BankerX-gen [Trj]
ClamAV Win.Dropper.Qakbot-7709653-0
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.vho
BitDefender Gen:Heur.Mint.Regotet.1
NANO-Antivirus Trojan.Win32.Inject3.hjlumc
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.10b9ebb7
Ad-Aware Gen:Heur.Mint.Regotet.1
Sophos Mal/Generic-R + Mal/EncPk-APV
Comodo Malware@#2y53gexwnv8cr
F-Secure Trojan.TR/Crypt.Agent.ftchp
DrWeb Trojan.Inject3.39277
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition W32/PinkSbot-GN!E5607C54C026
Emsisoft Gen:Heur.Mint.Regotet.1 (B)
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.Androm.auwh
Avira TR/Crypt.Agent.ftchp
Antiy-AVL Trojan/Win32.Qakbot
Gridinsoft Trojan.Win32.Kryptik.ba
Microsoft Trojan:Win32/Qbot.MX!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.vho
GData Gen:Heur.Mint.Regotet.1
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.QBot.R335010
McAfee W32/PinkSbot-GN!E5607C54C026
MAX malware (ai score=89)
VBA32 BScope.TrojanRansom.Shade
Malwarebytes Trojan.Qbot
ESET-NOD32 a variant of Win32/Kryptik.HDSI
TrendMicro-HouseCall Backdoor.Win32.QAKBOT.SME
Rising Trojan.Kryptik!1.C427 (CLASSIC)
Yandex Trojan.Kryptik!IrAFfUZuxcw
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-27 20:08:41

Imports

Library KERNEL32.dll:
• 0x5f55b4 VirtualAlloc
• 0x5f55b8 GetModuleHandleW
• 0x5f55bc GetDiskFreeSpaceExW
• 0x5f55c0 HeapAlloc
• 0x5f55c4 HeapSize
• 0x5f55c8 GetProcessHeap
• 0x5f55cc HeapFree
• 0x5f55d0 WideCharToMultiByte
• 0x5f55d4 HeapReAlloc
• 0x5f55e0 lstrcpyW
• 0x5f55e4 GlobalUnlock
• 0x5f55e8 GlobalFree
• 0x5f55ec GlobalHandle
• 0x5f55f0 GlobalLock
• 0x5f55f4 DebugBreak
• 0x5f55f8 GlobalAlloc
• 0x5f55fc GetLastError
• 0x5f5604 MultiByteToWideChar
• 0x5f5608 FreeLibrary
• 0x5f560c GetProcAddress
• 0x5f5614 LoadLibraryW
• 0x5f5618 GetSystemDirectoryW
• 0x5f5620 GetFileAttributesW
• 0x5f5624 GetModuleFileNameW
• 0x5f562c GetComputerNameW
• 0x5f5634 GetVersionExW
• 0x5f5638 LocalAlloc
• 0x5f563c LocalFree
• 0x5f5640 MulDiv
• 0x5f5644 CloseHandle
• 0x5f5648 CreateFileW
• 0x5f564c GetTickCount
• 0x5f5650 WriteFile
• 0x5f5654 GetCurrentThreadId
• 0x5f5658 lstrlenW
• 0x5f565c SetLastError
• 0x5f5660 GetSystemInfo
• 0x5f5664 GetLocalTime
• 0x5f5668 WinExec
• 0x5f566c CreateProcessW
• 0x5f5670 GetDriveTypeW
• 0x5f5674 GetStartupInfoW
• 0x5f567c GetVersion
• 0x5f5680 DeleteFileW
• 0x5f5684 GlobalSize
• 0x5f5688 FindNextFileA
• 0x5f568c DeleteFileA
• 0x5f5690 FindClose
• 0x5f5694 FindFirstFileA
• 0x5f5698 lstrcpyA
• 0x5f569c GetFileAttributesA
• 0x5f56a0 SearchPathA
• 0x5f56a4 GetTempPathA
• 0x5f56a8 lstrlenA
• 0x5f56ac SetFilePointer
• 0x5f56b0 CreateFileA
• 0x5f56b4 ResumeThread
• 0x5f56b8 SetPriorityClass
• 0x5f56bc GetCurrentThread
• 0x5f56c0 SetThreadPriority
• 0x5f56c4 CreateProcessA
• 0x5f56c8 GetModuleFileNameA
• 0x5f56cc RemoveDirectoryA
• 0x5f56d0 lstrcmpiA
• 0x5f56d4 GetSystemDirectoryA
• 0x5f56d8 SetStdHandle
• 0x5f56dc LoadLibraryA
• 0x5f56e0 GetStringTypeW
• 0x5f56e4 GetStringTypeA
• 0x5f56e8 LCMapStringW
• 0x5f56ec FlushFileBuffers
• 0x5f56f0 LCMapStringA
• 0x5f56f4 lstrcatA
• 0x5f56f8 GetCurrentProcess
• 0x5f56fc RtlUnwind
• 0x5f5700 VirtualFree
• 0x5f5704 GetModuleHandleA
• 0x5f5708 GetStartupInfoA
• 0x5f570c GetCommandLineA
• 0x5f5710 ExitProcess
• 0x5f5714 GetCPInfo
• 0x5f5718 GetACP
• 0x5f571c GetOEMCP
• 0x5f5720 TerminateProcess
• 0x5f5738 SetHandleCount
• 0x5f573c GetStdHandle
• 0x5f5740 GetFileType
• 0x5f5748 GetVersionExA
• 0x5f574c HeapDestroy
• 0x5f5750 HeapCreate
Library USER32.dll:
• 0x5f5758 LoadIconW
• 0x5f575c LoadIconA
• 0x5f5760 LoadCursorFromFileW
• 0x5f5764 GetSystemMetrics
• 0x5f5768 GetDlgCtrlID
• 0x5f576c GetListBoxInfo
• 0x5f5770 GetThreadDesktop
• 0x5f5774 ShowCaret
• 0x5f5778 DestroyWindow
• 0x5f577c GetClipboardViewer
• 0x5f5780 GetTopWindow
• 0x5f5784 CharLowerA
Library GDI32.dll:
• 0x5f578c GetStockObject
• 0x5f5790 UnrealizeObject
• 0x5f5794 CreateMetaFileA
• 0x5f5798 CreatePatternBrush
• 0x5f579c GetPolyFillMode
• 0x5f57a0 DeleteDC
• 0x5f57a4 FillPath
Library ADVAPI32.dll:
• 0x5f57ac RegOpenKeyA
• 0x5f57b0 RegQueryValueExA
Library ole32.dll:
• 0x5f57bc CoUninitialize

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49189 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.