5.0
中危
51 个模型检测该样本为恶意！
重新分析
更多

46b3109edcdd1cde67200eb9e4ae5c2120837a07e891266a04dd033d49bea774

e9f17c426bdb82b82808d45556b35c07.exe

分析耗时

64s

最近分析

文件大小

17.0KB
静态报毒 动态报毒 A + TROJ ACVIA AI SCORE=83 AIZD CBGHX@0 COBALT COBALTSTRIKE CONFIDENCE DIPLE FQGB GEN4 GENCIRC GENKD GENOME HIGH CONFIDENCE HTHIJZ METER METERPRETER R03BC0CHM20 R266914 SCORE TNGS UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Trojan-FQGB!E9F17C426BDB 20200910 6.0.6.653
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Alibaba TrojanDownloader:Application/Cobalt.9cf63722 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win64:Malware-gen 20200910 18.4.3895.0
Kingsoft 20200910 2013.8.14.323
Tencent Malware.Win32.Gencirc.10b3ac55 20200910 1.0.0.1
静态指标
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619976279.448644
__exception__
stacktrace: 
0x3b0030
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c
0xcc000c

registers.r14: 1453503984
registers.r9: 0
registers.rcx: 110
registers.rsi: 110
registers.r10: 0
registers.rbx: 3867094
registers.rdi: 0
registers.r11: 514
registers.r8: 8791716488948
registers.rdx: 2009605728
registers.rbp: 3866634
registers.r15: 0
registers.r12: 0
registers.rsp: 9305192
registers.rax: 0
registers.r13: 0
exception.instruction_r: ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed
exception.instruction: lodsb al, byte ptr [rsi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x3b0030
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619976245.792644
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000003b0000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619976254.464644
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 107.174.144.153
host 172.217.24.14
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619976257.057644
RegSetValueExA
key_handle: 0x0000000000000334
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619976257.057644
RegSetValueExA
key_handle: 0x0000000000000334
value: °‘w\?×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619976257.057644
RegSetValueExA
key_handle: 0x0000000000000334
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619976257.057644
RegSetValueExW
key_handle: 0x0000000000000334
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619976257.057644
RegSetValueExA
key_handle: 0x000000000000034c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619976257.057644
RegSetValueExA
key_handle: 0x000000000000034c
value: °‘w\?×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619976257.057644
RegSetValueExA
key_handle: 0x000000000000034c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619976257.120644
RegSetValueExW
key_handle: 0x0000000000000330
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.CobaltStrike.A
FireEye Generic.mg.e9f17c426bdb82b8
CAT-QuickHeal Trojan.Win64
McAfee Trojan-FQGB!E9F17C426BDB
Cylance Unsafe
Zillya Downloader.Cobalt.Win64.1
CrowdStrike win/malicious_confidence_80% (W)
Alibaba TrojanDownloader:Application/Cobalt.9cf63722
K7GW Trojan-Downloader ( 00500b3e1 )
K7AntiVirus Trojan-Downloader ( 00500b3e1 )
Arcabit Trojan.CobaltStrike.A
Invincea ML/PE-A + Troj/Meter-D
Cyren W64/Diple.V
Symantec Backdoor.Cobalt!gen4
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win64.Cobalt.a
BitDefender Trojan.CobaltStrike.A
NANO-Antivirus Trojan.Win64.ShellCode.hthijz
ViRobot Trojan.Win32.Z.Cobalt.17408.CO
Avast Win64:Malware-gen
Ad-Aware Trojan.CobaltStrike.A
TACHYON Trojan/W32.Diple.17408.B
Comodo TrojWare.Win32.Genome.cbghx@0
DrWeb Exploit.ShellCode.46
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R03BC0CHM20
Sophos Troj/Meter-D
Jiangmin Trojan.Diple.aizd
Avira TR/Dldr.Agent.acvia
Microsoft Trojan:Win64/Meterpreter.E
AegisLab Trojan.Win32.Diple.tngs
ZoneAlarm Trojan.Win64.Cobalt.a
GData Trojan.CobaltStrike.A
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_Diple.R266914
ALYac Trojan.CobaltStrike.A
MAX malware (ai score=83)
VBA32 Trojan.Win64.Cobalt
Malwarebytes Trojan.Meterpreter
ESET-NOD32 Win64/TrojanDownloader.Agent.AC
TrendMicro-HouseCall TROJ_GEN.R03BC0CHM20
Tencent Malware.Win32.Gencirc.10b3ac55
Ikarus Trojan.Agent
eGambit Unsafe.AI_Score_97%
Fortinet W32/Generic.AC.3741F6!tr
Webroot W32.Trojan.Genkd
AVG Win64:Malware-gen
Cybereason malicious.26bdb8
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (13 个事件)
dead_host 172.217.160.110:443
dead_host 192.168.56.101:49180
dead_host 192.168.56.101:49190
dead_host 192.168.56.101:49192
dead_host 172.217.24.14:443
dead_host 107.174.144.153:9002
dead_host 192.168.56.101:49188
dead_host 192.168.56.101:49187
dead_host 192.168.56.101:49186
dead_host 192.168.56.101:49183
dead_host 192.168.56.101:49185
dead_host 192.168.56.101:49182
dead_host 192.168.56.101:49184
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-03-23 04:35:11

Imports

Library KERNEL32.dll:
• 0x40820c CreateThread
• 0x408224 GetCurrentProcess
• 0x40822c GetCurrentProcessId
• 0x408234 GetCurrentThreadId
• 0x40823c GetLastError
• 0x408244 GetModuleHandleA
• 0x40824c GetProcAddress
• 0x408254 GetStartupInfoA
• 0x408264 GetTickCount
• 0x40827c LoadLibraryW
• 0x40828c RtlAddFunctionTable
• 0x408294 RtlCaptureContext
• 0x4082a4 RtlVirtualUnwind
• 0x4082b4 Sleep
• 0x4082bc TerminateProcess
• 0x4082c4 TlsGetValue
• 0x4082d4 VirtualAlloc
• 0x4082dc VirtualProtect
• 0x4082e4 VirtualQuery
Library msvcrt.dll:
• 0x4082fc __dllonexit
• 0x408304 __getmainargs
• 0x40830c __initenv
• 0x408314 __iob_func
• 0x40831c __lconv_init
• 0x408324 __set_app_type
• 0x40832c __setusermatherr
• 0x408334 _acmdln
• 0x40833c _amsg_exit
• 0x408344 _cexit
• 0x40834c _fmode
• 0x408354 _initterm
• 0x40835c _lock
• 0x408364 _onexit
• 0x40836c _unlock
• 0x408374 abort
• 0x40837c calloc
• 0x408384 exit
• 0x40838c fprintf
• 0x408394 free
• 0x40839c fwrite
• 0x4083a4 malloc
• 0x4083ac memcpy
• 0x4083b4 signal
• 0x4083bc strlen
• 0x4083c4 strncmp
• 0x4083cc vfprintf

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.