SmartHawk

13.6

0-day

54 个模型检测该样本为恶意！

重新分析

下载样本

814a5dc8dbe791a8e554c6823eedb3b4e9bfcd1006901df2f3468f71d1dd8437

ea1fd15ccebbaf20b2d2c20e59289e2c.exe

分析耗时

99s

最近分析

文件大小

784.0KB

静态报毒动态报毒 AGENTTESLA AI SCORE=88 ATTRIBUTE AVSARHER BTJEKX CONFIDENCE ELDORADO FAREIT GDSDA GENERICKDZ HIGEI HIGH CONFIDENCE HIGHCONFIDENCE HPPVOU KRYPTIK LOKIBOT MALICIOUS PE MALWARE@#3O0UE1R8XMD3T MALWAREX MSILKRYPT NEGASTEAL PACKEDNET PCRYPT R346455 SCORE SMAUJ STATIC AI SUSGEN UNSAFE YAKBEEXMSIL 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:MSIL/AgentTesla.75fa88f9	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
McAfee	Fareit-FXU!EA1FD15CCEBB	20201211	6.0.6.653
Tencent		20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (8 个事件)

Time & API	Arguments	Status	Return
1619982987.547626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.391626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.406626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.563626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.578626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.578626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.828626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619982989.844626 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (5 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951422.890625 IsDebuggerPresent		failed	0	0
1619951422.906625 IsDebuggerPresent		failed	0	0
1619951475.374625 IsDebuggerPresent		failed	0	0
1619982974.985626 IsDebuggerPresent		failed	0	0
1619982974.985626 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951422.921625 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 个事件)

Time & API	Arguments	Status	Return
1619982976.375626 bind	ip_address: 127.0.0.1 socket: 600 port: 0	success	0
1619982976.375626 listen	socket: 600 backlog: 2147483647	success	0
1619982976.375626 accept	ip_address: 127.0.0.1 socket: 600 port: 0	failed	4294967295

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://whatismyipaddress.com/

Performs some HTTP requests (1 个事件)

request

GET http://whatismyipaddress.com/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 183 个事件)

Time & API	Arguments	Status	Return
1619951422.124625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004b0000	success	0
1619951422.124625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004e0000	success	0
1619951422.765625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02050000	success	0
1619951422.765625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success	0
1619951422.812625 NtProtectVirtualMemory	process_identifier: 420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619951422.890625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00610000	success	0
1619951422.890625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00610000	success	0
1619951422.906625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005aa000	success	0
1619951422.906625 NtProtectVirtualMemory	process_identifier: 420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619951422.906625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a2000	success	0
1619951423.109625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b2000	success	0
1619951423.203625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d5000	success	0
1619951423.218625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005db000	success	0
1619951423.218625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d7000	success	0
1619951423.359625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b3000	success	0
1619951423.406625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bc000	success	0
1619951424.062625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b4000	success	0
1619951424.062625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b6000	success	0
1619951424.187625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b7000	success	0
1619951424.203625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a0000	success	0
1619951424.374625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ca000	success	0
1619951424.374625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005c7000	success	0
1619951424.531625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005c6000	success	0
1619951424.609625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00611000	success	0
1619951424.624625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00612000	success	0
1619951424.687625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a1000	success	0
1619951424.687625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00613000	success	0
1619951424.687625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00614000	success	0
1619951424.828625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b8000	success	0
1619951425.359625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00615000	success	0
1619951425.359625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00619000	success	0
1619951425.609625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a2000	success	0
1619951425.624625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a3000	success	0
1619951427.390625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ba000	success	0
1619951429.093625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b9000	success	0
1619951430.562625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02140000	success	0
1619951430.687625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02141000	success	0
1619951430.874625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a5000	success	0
1619951430.921625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02142000	success	0
1619951430.937625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a6000	success	0
1619951469.046625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02171000	success	0
1619951469.156625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008a9000	success	0
1619951469.328625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005ac000	success	0
1619951469.421625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02143000	success	0
1619951469.437625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bd000	success	0
1619951469.437625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008aa000	success	0
1619951469.609625 NtProtectVirtualMemory	process_identifier: 420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 529408 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x06810400	failed	3221225550
1619951474.234625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008ab000	success	0
1619951474.234625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02144000	success	0
1619951474.234625 NtAllocateVirtualMemory	process_identifier: 420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008ac000	success	0

Looks up the external IP address (1 个事件)

domain

whatismyipaddress.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619982980.516626 GetAdaptersAddresses	flags: 1158 family: 0	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.84863773347509

section

{'size_of_data': '0x000c3600', 'virtual_address': '0x00002000', 'entropy': 7.84863773347509, 'name': '.text', 'virtual_size': '0x000c35ec'}

description

A section with a high entropy has been found

entropy

0.9974473516273133

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951469.562625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951475.593625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2032 process_handle: 0x000098c0	failed	0	0
1619951475.593625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2032 process_handle: 0x000098c0	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951475.515625 NtAllocateVirtualMemory	process_identifier: 2032 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000091d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619951475.609625 NtAllocateVirtualMemory	process_identifier: 324 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004660 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

ea1fd15ccebbaf20b2d2c20e59289e2c.exe tried to sleep 2728208 seconds, actually delayed analysis time by 2728208 seconds

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 420 manipulating memory of non-child process 2032
1619951475.515625 NtAllocateVirtualMemory	process_identifier: 2032 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000091d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619951475.609625 WriteProcessMemory	process_identifier: 324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙ_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x00004660 base_address: 0x00400000	success	1
1619951475.624625 WriteProcessMemory	process_identifier: 324 buffer: ð; process_handle: 0x00004660 base_address: 0x00486000	success	1
1619951475.624625 WriteProcessMemory	process_identifier: 324 buffer: @ process_handle: 0x00004660 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951475.609625 WriteProcessMemory	process_identifier: 324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙ_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x00004660 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 420 called NtSetContextThread to modify thread in remote process 324
1619951475.624625 NtSetContextThread	thread_handle: 0x000098c0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 324	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 420 resumed a thread in remote process 324
1619951475.656625 NtResumeThread	thread_handle: 0x000098c0 suspend_count: 1 process_identifier: 324	success	0	0

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 个事件)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

Executed a process and injected code into it, probably while unpacking (41 个事件)

Time & API	Arguments	Status	Return
1619951422.906625 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 420	success	0
1619951422.906625 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 420	success	0
1619951422.921625 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 420	success	0
1619951474.249625 NtGetContextThread	thread_handle: 0x00000128	success	0
1619951474.249625 NtGetContextThread	thread_handle: 0x00000128	success	0
1619951474.249625 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 420	success	0
1619951475.296625 NtResumeThread	thread_handle: 0x00007d30 suspend_count: 1 process_identifier: 420	success	0
1619951475.296625 NtResumeThread	thread_handle: 0x0000adbc suspend_count: 1 process_identifier: 420	success	0
1619951475.343625 NtGetContextThread	thread_handle: 0x0000adbc	success	0
1619951475.343625 NtGetContextThread	thread_handle: 0x0000adbc	success	0
1619951475.359625 NtResumeThread	thread_handle: 0x0000adbc suspend_count: 1 process_identifier: 420	success	0
1619951475.515625 CreateProcessInternalW	thread_identifier: 2444 thread_handle: 0x0000bd14 process_identifier: 2032 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ea1fd15ccebbaf20b2d2c20e59289e2c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ea1fd15ccebbaf20b2d2c20e59289e2c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000091d0 inherit_handles: 0	success	1
1619951475.515625 NtGetContextThread	thread_handle: 0x0000bd14	success	0
1619951475.515625 NtAllocateVirtualMemory	process_identifier: 2032 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000091d0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619951475.609625 CreateProcessInternalW	thread_identifier: 2964 thread_handle: 0x000098c0 process_identifier: 324 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ea1fd15ccebbaf20b2d2c20e59289e2c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ea1fd15ccebbaf20b2d2c20e59289e2c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00004660 inherit_handles: 0	success	1
1619951475.609625 NtGetContextThread	thread_handle: 0x000098c0	success	0
1619951475.609625 NtAllocateVirtualMemory	process_identifier: 324 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00004660 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619951475.609625 WriteProcessMemory	process_identifier: 324 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙ_àì4î @ @S 2` H.textôë ì `.rsrc2 2î@@.reloc` @B process_handle: 0x00004660 base_address: 0x00400000	success	1
1619951475.609625 WriteProcessMemory	process_identifier: 324 buffer: process_handle: 0x00004660 base_address: 0x00402000	success	1
1619951475.624625 WriteProcessMemory	process_identifier: 324 buffer: process_handle: 0x00004660 base_address: 0x00482000	success	1
1619951475.624625 WriteProcessMemory	process_identifier: 324 buffer: ð; process_handle: 0x00004660 base_address: 0x00486000	success	1
1619951475.624625 WriteProcessMemory	process_identifier: 324 buffer: @ process_handle: 0x00004660 base_address: 0x7efde008	success	1
1619951475.624625 NtSetContextThread	thread_handle: 0x000098c0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4721646 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 324	success	0
1619951475.656625 NtResumeThread	thread_handle: 0x000098c0 suspend_count: 1 process_identifier: 324	success	0
1619982974.985626 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 324	success	0
1619982974.985626 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 324	success	0
1619982975.000626 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 324	success	0
1619982976.391626 NtResumeThread	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 324	success	0
1619982983.172626 NtResumeThread	thread_handle: 0x00000440 suspend_count: 1 process_identifier: 324	success	0
1619982988.297626 NtResumeThread	thread_handle: 0x000004b0 suspend_count: 1 process_identifier: 324	success	0
1619982989.219626 NtResumeThread	thread_handle: 0x000004fc suspend_count: 1 process_identifier: 324	success	0
1619982989.578626 NtResumeThread	thread_handle: 0x00000560 suspend_count: 1 process_identifier: 324	success	0
1619982989.578626 NtResumeThread	thread_handle: 0x00000578 suspend_count: 1 process_identifier: 324	success	0
1619982989.578626 NtResumeThread	thread_handle: 0x0000058c suspend_count: 1 process_identifier: 324	success	0
1619982989.578626 NtResumeThread	thread_handle: 0x000005a0 suspend_count: 1 process_identifier: 324	success	0
1619982989.688626 NtResumeThread	thread_handle: 0x000005b4 suspend_count: 1 process_identifier: 324	success	0
1619982989.688626 NtResumeThread	thread_handle: 0x000005cc suspend_count: 1 process_identifier: 324	success	0
1619982989.703626 NtResumeThread	thread_handle: 0x000005e0 suspend_count: 1 process_identifier: 324	success	0
1619982989.703626 NtResumeThread	thread_handle: 0x000005f4 suspend_count: 1 process_identifier: 324	success	0
1619982989.828626 NtResumeThread	thread_handle: 0x00000624 suspend_count: 1 process_identifier: 324	success	0
1619982992.688626 NtResumeThread	thread_handle: 0x00000630 suspend_count: 1 process_identifier: 324	success	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.416
MicroWorld-eScan	Trojan.GenericKDZ.69093
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKDZ.69093
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2316776
Sangfor	Malware
K7AntiVirus	Trojan ( 0056b6b31 )
Alibaba	Trojan:MSIL/AgentTesla.75fa88f9
K7GW	Trojan ( 0056b6b31 )
Cybereason	malicious.8ea45e
Arcabit	Trojan.Generic.D10DE5
Cyren	W32/MSIL_Kryptik.BFZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.XCV
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.LokiBot-9164578-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKDZ.69093
NANO-Antivirus	Trojan.Win32.Crypt.hppvou
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKDZ.69093
Sophos	Mal/Generic-S
Comodo	Malware@#3o0ue1r8xmd3t
F-Secure	Trojan.TR/Kryptik.higei
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.MSIL.NEGASTEAL.SMAUJ
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
FireEye	Generic.mg.ea1fd15ccebbaf20
Emsisoft	Trojan.GenericKDZ.69093 (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/Kryptik.higei
MAX	malware (ai score=88)
Antiy-AVL	Trojan/MSIL.Crypt
Gridinsoft	Trojan.Win32.Agent.dd!n
Microsoft	Trojan:MSIL/AgentTesla.AX!MTB
AegisLab	Trojan.MSIL.Crypt.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKDZ.69093
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MSILKrypt.R346455
McAfee	Fareit-FXU!EA1FD15CCEBB
Malwarebytes	Trojan.PCrypt.MSIL.Generic
TrendMicro-HouseCall	TrojanSpy.MSIL.NEGASTEAL.SMAUJ
Yandex	Trojan.AvsArher.bTJEKx
Ikarus	Trojan.MSIL.Inject
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	MSIL/Kryptik.XFP!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.27.142:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-29 07:50:09

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
whatismyipaddress.com	A 104.16.154.36 A 104.16.155.36	104.16.155.36
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49189	104.16.154.36 whatismyipaddress.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://whatismyipaddress.com/	GET / HTTP/1.1 Host: whatismyipaddress.com Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.