11.0
0-day
57 个模型检测该样本为恶意！
重新分析
更多

e27026fb1bd7a7e0f88156f04e0186fb4e9f395cb57d260e7a0517838a09b32a

eca2a7b98d0579370bdaf34bad66dc9b.exe

分析耗时

100s

最近分析

文件大小

944.5KB
静态报毒 动态报毒 7GW@ACXNEUCI AI SCORE=82 AIDETECTVM ALI2000015 AUTOIT CLOUD CONFIDENCE DELF DELFINJECT DELPHILESS EMTN EMUK FAREIT FORMBOOK GENERICIH GENERICKD HIGH CONFIDENCE HPCXYF KRYPTIK LOKIBOT MALWARE2 NANOCORE R002C0DGU20 S15398965 SCORE SUSPICIOUS PE TFGKX TSCOPE TSKO UNSAFE X2091 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200823 18.4.3895.0
Tencent 20200824 1.0.0.1
Kingsoft 20200824 2013.8.14.323
McAfee Fareit-FPQ!ECA2A7B98D05 20200823 6.0.6.653
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (10 个事件)
Time & API Arguments Status Return Repeated
1620018473.625249
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb5148d
success 0 0
1620018483.468751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff58148d
success 0 0
1620018491.421626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb1148d
success 0 0
1620018498.749874
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5d148d
success 0 0
1620018505.046751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd93148d
success 0 0
1620018512.796626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff58148d
success 0 0
1620018518.109124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff51148d
success 0 0
1620018523.765124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff34148d
success 0 0
1620018528.780501
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff53148d
success 0 0
1620018535.046501
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
drryhunbgb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff61148d
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 316 个事件)
Time & API Arguments Status Return Repeated
1620018469.671751
NtAllocateVirtualMemory
process_identifier: 2340
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1620018469.796751
NtAllocateVirtualMemory
process_identifier: 2340
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1620018469.796751
NtAllocateVirtualMemory
process_identifier: 2340
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00540000
success 0 0
1620018471.718374
NtAllocateVirtualMemory
process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1620018471.764374
NtAllocateVirtualMemory
process_identifier: 2368
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1620018471.780374
NtAllocateVirtualMemory
process_identifier: 2368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00540000
success 0 0
1620018472.750249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620018472.812249
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ee0000
success 0 0
1620018472.812249
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fa0000
success 0 0
1620018472.812249
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ee0000
success 0 0
1620018472.812249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005f2000
success 0 0
1620018473.594249
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018473.047249
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005e0000
success 0 0
1620018473.172249
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1620018473.172249
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00680000
success 0 0
1620018481.171499
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1620018481.264499
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00890000
success 0 0
1620018481.280499
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x008c0000
success 0 0
1620018483.202751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620018483.264751
NtAllocateVirtualMemory
process_identifier: 3256
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02030000
success 0 0
1620018483.264751
NtAllocateVirtualMemory
process_identifier: 3256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02140000
success 0 0
1620018483.264751
NtAllocateVirtualMemory
process_identifier: 3256
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02030000
success 0 0
1620018483.264751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1620018483.327751
NtProtectVirtualMemory
process_identifier: 3256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (27 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.608730496145183 section {'size_of_data': '0x00071c00', 'virtual_address': '0x00080000', 'entropy': 7.608730496145183, 'name': '.rsrc', 'virtual_size': '0x00071b68'} description A section with a high entropy has been found
entropy 0.48224695283518815 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process drryhunbgb.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (32 个事件)
Time & API Arguments Status Return Repeated
1620018469.811751
Process32NextW
process_name: eca2a7b98d0579370bdaf34bad66dc9b.exe
snapshot_handle: 0x000000f4
process_identifier: 2340
failed 0 0
1620018471.796374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2196
failed 0 0
1620018473.250249
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3120
failed 0 0
1620018480.437249
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x000001a8
process_identifier: 1404
failed 0 0
1620018481.280499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3236
failed 0 0
1620018483.546999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3408
failed 0 0
1620018488.311999
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000164
process_identifier: 3316
failed 0 0
1620018489.108751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3488
failed 0 0
1620018492.171501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3664
failed 0 0
1620018495.624501
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000148
process_identifier: 3568
failed 0 0
1620018496.483626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3752
failed 0 0
1620018499.562249
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3912
failed 0 0
1620018501.906249
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000114
process_identifier: 3824
failed 0 0
1620018503.422124
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3144
failed 0 0
1620018506.233751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1208
failed 0 0
1620018509.139751
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000134
process_identifier: 1272
failed 0 0
1620018510.639626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3296
failed 0 0
1620018513.530626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3472
failed 0 0
1620018515.827626
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000134
process_identifier: 3388
failed 0 0
1620018516.718999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3592
failed 0 0
1620018518.889374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2516
failed 0 0
1620018521.843374
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000148
process_identifier: 3680
failed 0 0
1620018522.389374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3876
failed 0 0
1620018524.296874
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2264
failed 0 0
1620018525.639874
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x00000118
process_identifier: 4056
failed 0 0
1620018526.468499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1868
failed 0 0
1620018529.469249
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x000000f4
process_identifier: 3452
failed 0 0
1620018531.984249
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000124
process_identifier: 3452
failed 0 0
1620018533.405626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3068
failed 0 0
1620018536.187249
Process32NextW
process_name: googleupdate.exe
snapshot_handle: 0x000000f4
process_identifier: 3920
failed 0 0
1620018538.203249
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x00000128
process_identifier: 1856
failed 0 0
1620018539.155751
Process32NextW
process_name: drryhunbgb.exe
snapshot_handle: 0x000000f4
process_identifier: 876
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1620018470.733751
NtAllocateVirtualMemory
process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2340 created a thread in remote process 2252
Time & API Arguments Status Return Repeated
1620018470.733751
NtQueueApcThread
thread_handle: 0x00000104
process_identifier: 2252
function_address: 0x000f05c0
parameter: 0x00100000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1620018470.733751
WriteProcessMemory
process_identifier: 2252
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000f0000
success 1 0
1620018470.733751
WriteProcessMemory
process_identifier: 2252
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\eca2a7b98d0579370bdaf34bad66dc9b.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\eca2a7b98d0579370bdaf34bad66dc9b.exe" websEt PkdVxDLIsh = CrEateobjeCt("wScrIpt.shElL") pkDVXDlIsH.run """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x00100000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (20 个事件)
Process injection Process 2368 called NtSetContextThread to modify thread in remote process 2456
Process injection Process 3180 called NtSetContextThread to modify thread in remote process 3256
Process injection Process 3432 called NtSetContextThread to modify thread in remote process 3500
Process injection Process 3684 called NtSetContextThread to modify thread in remote process 3764
Process injection Process 4028 called NtSetContextThread to modify thread in remote process 2668
Process injection Process 3064 called NtSetContextThread to modify thread in remote process 3128
Process injection Process 2796 called NtSetContextThread to modify thread in remote process 3600
Process injection Process 3776 called NtSetContextThread to modify thread in remote process 3868
Process injection Process 3828 called NtSetContextThread to modify thread in remote process 2244
Process injection Process 4064 called NtSetContextThread to modify thread in remote process 3624
Time & API Arguments Status Return Repeated
1620018471.999374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2456
success 0 0
1620018481.655499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3256
success 0 0
1620018490.514751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3500
success 0 0
1620018497.030626
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3764
success 0 0
1620018503.812124
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
1620018511.577626
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3128
success 0 0
1620018516.952999
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3600
success 0 0
1620018522.546374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3868
success 0 0
1620018527.171499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2244
success 0 0
1620018533.780626
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3624
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (20 个事件)
Process injection Process 2368 resumed a thread in remote process 2456
Process injection Process 3180 resumed a thread in remote process 3256
Process injection Process 3432 resumed a thread in remote process 3500
Process injection Process 3684 resumed a thread in remote process 3764
Process injection Process 4028 resumed a thread in remote process 2668
Process injection Process 3064 resumed a thread in remote process 3128
Process injection Process 2796 resumed a thread in remote process 3600
Process injection Process 3776 resumed a thread in remote process 3868
Process injection Process 3828 resumed a thread in remote process 2244
Process injection Process 4064 resumed a thread in remote process 3624
Time & API Arguments Status Return Repeated
1620018472.561374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2456
success 0 0
1620018482.999499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3256
success 0 0
1620018491.155751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3500
success 0 0
1620018498.093626
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3764
success 0 0
1620018504.265124
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2668
success 0 0
1620018512.233626
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3128
success 0 0
1620018517.639999
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3600
success 0 0
1620018523.218374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3868
success 0 0
1620018528.046499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2244
success 0 0
1620018534.514626
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3624
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 86 个事件)
Time & API Arguments Status Return Repeated
1620018470.733751
CreateProcessInternalW
thread_identifier: 2404
thread_handle: 0x00000104
process_identifier: 2252
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018470.733751
NtAllocateVirtualMemory
process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1620018470.733751
NtAllocateVirtualMemory
process_identifier: 2252
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1620018470.733751
WriteProcessMemory
process_identifier: 2252
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000f0000
success 1 0
1620018470.733751
WriteProcessMemory
process_identifier: 2252
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\eca2a7b98d0579370bdaf34bad66dc9b.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\eca2a7b98d0579370bdaf34bad66dc9b.exe" websEt PkdVxDLIsh = CrEateobjeCt("wScrIpt.shElL") pkDVXDlIsH.run """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x00100000
success 1 0
1620018471.327374
CreateProcessInternalW
thread_identifier: 2764
thread_handle: 0x000000d0
process_identifier: 2368
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1620018471.874374
CreateProcessInternalW
thread_identifier: 2264
thread_handle: 0x00000104
process_identifier: 2456
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018471.874374
NtUnmapViewOfSection
process_identifier: 2456
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018471.889374
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2456
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018471.999374
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1620018471.999374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2456
success 0 0
1620018472.561374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2456
success 0 0
1620018472.686374
CreateProcessInternalW
thread_identifier: 1108
thread_handle: 0x00000108
process_identifier: 1404
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe" 2 2456 19290593
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1620018480.484249
CreateProcessInternalW
thread_identifier: 3184
thread_handle: 0x000001ac
process_identifier: 3180
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001b0
inherit_handles: 0
success 1 0
1620018481.468499
CreateProcessInternalW
thread_identifier: 3260
thread_handle: 0x00000104
process_identifier: 3256
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018481.468499
NtUnmapViewOfSection
process_identifier: 3256
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018481.483499
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3256
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018481.655499
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1620018481.655499
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3256
success 0 0
1620018482.999499
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3256
success 0 0
1620018483.155499
CreateProcessInternalW
thread_identifier: 3320
thread_handle: 0x00000108
process_identifier: 3316
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe" 2 3256 19301031
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1620018488.499999
CreateProcessInternalW
thread_identifier: 3436
thread_handle: 0x00000168
process_identifier: 3432
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000016c
inherit_handles: 0
success 1 0
1620018489.374751
CreateProcessInternalW
thread_identifier: 3504
thread_handle: 0x00000104
process_identifier: 3500
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018489.374751
NtUnmapViewOfSection
process_identifier: 3500
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018489.389751
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3500
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018490.514751
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1620018490.514751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3500
success 0 0
1620018491.155751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3500
success 0 0
1620018491.343751
CreateProcessInternalW
thread_identifier: 3572
thread_handle: 0x00000108
process_identifier: 3568
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe" 2 3500 19309187
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1620018495.780501
CreateProcessInternalW
thread_identifier: 3688
thread_handle: 0x0000014c
process_identifier: 3684
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
1620018496.764626
CreateProcessInternalW
thread_identifier: 3768
thread_handle: 0x00000104
process_identifier: 3764
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018496.764626
NtUnmapViewOfSection
process_identifier: 3764
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018496.780626
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3764
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018497.030626
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1620018497.030626
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3764
success 0 0
1620018498.093626
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3764
success 0 0
1620018498.764626
CreateProcessInternalW
thread_identifier: 3828
thread_handle: 0x00000108
process_identifier: 3824
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe" 2 3764 19316125
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1620018502.437249
CreateProcessInternalW
thread_identifier: 4032
thread_handle: 0x00000118
process_identifier: 4028
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1620018503.672124
CreateProcessInternalW
thread_identifier: 1804
thread_handle: 0x00000104
process_identifier: 2668
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018503.672124
NtUnmapViewOfSection
process_identifier: 2668
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018503.687124
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2668
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018503.797124
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1620018503.812124
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
1620018504.265124
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2668
success 0 0
1620018505.578124
CreateProcessInternalW
thread_identifier: 1824
thread_handle: 0x00000108
process_identifier: 1272
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe" 2 2668 19322296
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1620018510.280751
CreateProcessInternalW
thread_identifier: 3068
thread_handle: 0x00000138
process_identifier: 3064
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000013c
inherit_handles: 0
success 1 0
1620018510.952626
CreateProcessInternalW
thread_identifier: 3332
thread_handle: 0x00000104
process_identifier: 3128
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\drryhunbgb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1620018510.952626
NtUnmapViewOfSection
process_identifier: 3128
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1620018511.093626
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3128
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1620018511.577626
NtGetContextThread
thread_handle: 0x00000104
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34254607
FireEye Generic.mg.eca2a7b98d057937
CAT-QuickHeal Trojan.GenericIH.S15398965
ALYac Trojan.GenericKD.34254607
Cylance Unsafe
Zillya Trojan.Injector.Win32.754865
Sangfor Malware
K7AntiVirus Trojan ( 0056b6131 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056b6131 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Generic.D20AAF0F
Invincea heuristic
Cyren W32/Trojan.TSKO-6397
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Dropper.Nanocore-9235748-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.34254607
NANO-Antivirus Trojan.Win32.Stealer.hpcxyf
Paloalto generic.ml
ViRobot Trojan.Win32.Z.Kryptik.967168.A
Ad-Aware Trojan.GenericKD.34254607
F-Secure Trojan.TR/Kryptik.tfgkx
DrWeb Trojan.PWS.Stealer.19347
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DGU20
Sophos Mal/Generic-S
SentinelOne DFI - Suspicious PE
Jiangmin Trojan.Kryptik.byu
Avira TR/Kryptik.tfgkx
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Kryptik
Microsoft Trojan:Win32/FormBook.DE!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKD.34254607
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2091
Acronis suspicious
McAfee Fareit-FPQ!ECA2A7B98D05
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.LokiBot
Zoner Trojan.Win32.91606
ESET-NOD32 a variant of Win32/Injector.EMUK
TrendMicro-HouseCall TROJ_GEN.R002C0DGU20
Rising Trojan.Injector!1.C99D (CLOUD)
Ikarus Trojan-Dropper.Win32.Autoit
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47413c VirtualFree
• 0x474140 VirtualAlloc
• 0x474144 LocalFree
• 0x474148 LocalAlloc
• 0x47414c GetVersion
• 0x474150 GetCurrentThreadId
• 0x47415c VirtualQuery
• 0x474160 WideCharToMultiByte
• 0x474164 MultiByteToWideChar
• 0x474168 lstrlenA
• 0x47416c lstrcpynA
• 0x474170 LoadLibraryExA
• 0x474174 GetThreadLocale
• 0x474178 GetStartupInfoA
• 0x47417c GetProcAddress
• 0x474180 GetModuleHandleA
• 0x474184 GetModuleFileNameA
• 0x474188 GetLocaleInfoA
• 0x47418c GetCommandLineA
• 0x474190 FreeLibrary
• 0x474194 FindFirstFileA
• 0x474198 FindClose
• 0x47419c ExitProcess
• 0x4741a0 WriteFile
• 0x4741a8 RtlUnwind
• 0x4741ac RaiseException
• 0x4741b0 GetStdHandle
Library user32.dll:
• 0x4741b8 GetKeyboardType
• 0x4741bc LoadStringA
• 0x4741c0 MessageBoxA
• 0x4741c4 CharNextA
Library advapi32.dll:
• 0x4741cc RegQueryValueExA
• 0x4741d0 RegOpenKeyExA
• 0x4741d4 RegCloseKey
Library oleaut32.dll:
• 0x4741dc SysFreeString
• 0x4741e0 SysReAllocStringLen
• 0x4741e4 SysAllocStringLen
Library kernel32.dll:
• 0x4741ec TlsSetValue
• 0x4741f0 TlsGetValue
• 0x4741f4 LocalAlloc
• 0x4741f8 GetModuleHandleA
Library advapi32.dll:
• 0x474200 RegQueryValueExA
• 0x474204 RegOpenKeyExA
• 0x474208 RegCloseKey
Library kernel32.dll:
• 0x474210 lstrcpyA
• 0x474214 WriteFile
• 0x474218 WaitForSingleObject
• 0x47421c VirtualQuery
• 0x474220 VirtualAlloc
• 0x474224 Sleep
• 0x474228 SizeofResource
• 0x47422c SetThreadLocale
• 0x474230 SetFilePointer
• 0x474234 SetEvent
• 0x474238 SetErrorMode
• 0x47423c SetEndOfFile
• 0x474240 ResetEvent
• 0x474244 ReadFile
• 0x474248 MulDiv
• 0x47424c LockResource
• 0x474250 LoadResource
• 0x474254 LoadLibraryA
• 0x474260 GlobalUnlock
• 0x474264 GlobalReAlloc
• 0x474268 GlobalHandle
• 0x47426c GlobalLock
• 0x474270 GlobalFree
• 0x474274 GlobalFindAtomA
• 0x474278 GlobalDeleteAtom
• 0x47427c GlobalAlloc
• 0x474280 GlobalAddAtomA
• 0x474284 GetVersionExA
• 0x474288 GetVersion
• 0x47428c GetTickCount
• 0x474290 GetThreadLocale
• 0x474294 GetSystemInfo
• 0x474298 GetStringTypeExA
• 0x47429c GetStdHandle
• 0x4742a0 GetProcAddress
• 0x4742a4 GetModuleHandleA
• 0x4742a8 GetModuleFileNameA
• 0x4742ac GetLocaleInfoA
• 0x4742b0 GetLocalTime
• 0x4742b4 GetLastError
• 0x4742b8 GetFullPathNameA
• 0x4742bc GetDiskFreeSpaceA
• 0x4742c0 GetDateFormatA
• 0x4742c4 GetCurrentThreadId
• 0x4742c8 GetCurrentProcessId
• 0x4742cc GetCPInfo
• 0x4742d0 GetACP
• 0x4742d4 FreeResource
• 0x4742d8 InterlockedExchange
• 0x4742dc FreeLibrary
• 0x4742e0 FormatMessageA
• 0x4742e4 FindResourceA
• 0x4742e8 EnumCalendarInfoA
• 0x4742f4 CreateThread
• 0x4742f8 CreateFileA
• 0x4742fc CreateEventA
• 0x474300 CompareStringA
• 0x474304 CloseHandle
Library version.dll:
• 0x47430c VerQueryValueA
• 0x474314 GetFileVersionInfoA
Library gdi32.dll:
• 0x47431c UnrealizeObject
• 0x474320 StretchBlt
• 0x474324 SetWindowOrgEx
• 0x474328 SetViewportOrgEx
• 0x47432c SetTextColor
• 0x474330 SetStretchBltMode
• 0x474334 SetROP2
• 0x474338 SetPixel
• 0x47433c SetDIBColorTable
• 0x474340 SetBrushOrgEx
• 0x474344 SetBkMode
• 0x474348 SetBkColor
• 0x47434c SelectPalette
• 0x474350 SelectObject
• 0x474354 SaveDC
• 0x474358 RestoreDC
• 0x47435c Rectangle
• 0x474360 RectVisible
• 0x474364 RealizePalette
• 0x474368 PtVisible
• 0x47436c PatBlt
• 0x474370 MoveToEx
• 0x474374 MaskBlt
• 0x474378 LineTo
• 0x47437c IntersectClipRect
• 0x474380 GetWindowOrgEx
• 0x474384 GetTextMetricsA
• 0x474390 GetStockObject
• 0x474394 GetPixel
• 0x474398 GetPaletteEntries
• 0x47439c GetObjectA
• 0x4743a0 GetDeviceCaps
• 0x4743a4 GetDIBits
• 0x4743a8 GetDIBColorTable
• 0x4743ac GetDCOrgEx
• 0x4743b4 GetClipBox
• 0x4743b8 GetBrushOrgEx
• 0x4743bc GetBitmapBits
• 0x4743c0 ExcludeClipRect
• 0x4743c4 DeleteObject
• 0x4743c8 DeleteDC
• 0x4743cc CreateSolidBrush
• 0x4743d0 CreatePenIndirect
• 0x4743d4 CreatePen
• 0x4743d8 CreatePalette
• 0x4743e0 CreateFontIndirectA
• 0x4743e4 CreateDIBitmap
• 0x4743e8 CreateDIBSection
• 0x4743ec CreateCompatibleDC
• 0x4743f4 CreateBrushIndirect
• 0x4743f8 CreateBitmap
• 0x4743fc BitBlt
Library user32.dll:
• 0x474404 CreateWindowExA
• 0x474408 WindowFromPoint
• 0x47440c WinHelpA
• 0x474410 WaitMessage
• 0x474414 ValidateRect
• 0x474418 UpdateWindow
• 0x47441c UnregisterClassA
• 0x474420 UnhookWindowsHookEx
• 0x474424 TranslateMessage
• 0x47442c TrackPopupMenu
• 0x474434 ShowWindow
• 0x474438 ShowScrollBar
• 0x47443c ShowOwnedPopups
• 0x474440 ShowCursor
• 0x474444 SetWindowsHookExA
• 0x474448 SetWindowTextA
• 0x47444c SetWindowPos
• 0x474450 SetWindowPlacement
• 0x474454 SetWindowLongA
• 0x474458 SetTimer
• 0x47445c SetScrollRange
• 0x474460 SetScrollPos
• 0x474464 SetScrollInfo
• 0x474468 SetRect
• 0x47446c SetPropA
• 0x474470 SetParent
• 0x474474 SetMenuItemInfoA
• 0x474478 SetMenu
• 0x47447c SetForegroundWindow
• 0x474480 SetFocus
• 0x474484 SetCursor
• 0x474488 SetClassLongA
• 0x47448c SetCapture
• 0x474490 SetActiveWindow
• 0x474494 SendMessageA
• 0x474498 ScrollWindow
• 0x47449c ScreenToClient
• 0x4744a0 RemovePropA
• 0x4744a4 RemoveMenu
• 0x4744a8 ReleaseDC
• 0x4744ac ReleaseCapture
• 0x4744b8 RegisterClassA
• 0x4744bc RedrawWindow
• 0x4744c0 PtInRect
• 0x4744c4 PostQuitMessage
• 0x4744c8 PostMessageA
• 0x4744cc PeekMessageA
• 0x4744d0 OffsetRect
• 0x4744d4 OemToCharA
• 0x4744d8 MessageBoxA
• 0x4744dc MessageBeep
• 0x4744e0 MapWindowPoints
• 0x4744e4 MapVirtualKeyA
• 0x4744e8 LoadStringA
• 0x4744ec LoadKeyboardLayoutA
• 0x4744f0 LoadIconA
• 0x4744f4 LoadCursorA
• 0x4744f8 LoadBitmapA
• 0x4744fc KillTimer
• 0x474500 IsZoomed
• 0x474504 IsWindowVisible
• 0x474508 IsWindowEnabled
• 0x47450c IsWindow
• 0x474510 IsRectEmpty
• 0x474514 IsIconic
• 0x474518 IsDialogMessageA
• 0x47451c IsChild
• 0x474520 InvalidateRect
• 0x474524 IntersectRect
• 0x474528 InsertMenuItemA
• 0x47452c InsertMenuA
• 0x474530 InflateRect
• 0x474538 GetWindowTextA
• 0x47453c GetWindowRect
• 0x474540 GetWindowPlacement
• 0x474544 GetWindowLongA
• 0x474548 GetWindowDC
• 0x47454c GetTopWindow
• 0x474550 GetSystemMetrics
• 0x474554 GetSystemMenu
• 0x474558 GetSysColorBrush
• 0x47455c GetSysColor
• 0x474560 GetSubMenu
• 0x474564 GetScrollRange
• 0x474568 GetScrollPos
• 0x47456c GetScrollInfo
• 0x474570 GetPropA
• 0x474574 GetParent
• 0x474578 GetWindow
• 0x47457c GetMenuStringA
• 0x474580 GetMenuState
• 0x474584 GetMenuItemInfoA
• 0x474588 GetMenuItemID
• 0x47458c GetMenuItemCount
• 0x474590 GetMenu
• 0x474594 GetLastActivePopup
• 0x474598 GetKeyboardState
• 0x4745a0 GetKeyboardLayout
• 0x4745a4 GetKeyState
• 0x4745a8 GetKeyNameTextA
• 0x4745ac GetIconInfo
• 0x4745b0 GetForegroundWindow
• 0x4745b4 GetFocus
• 0x4745b8 GetDlgItem
• 0x4745bc GetDesktopWindow
• 0x4745c0 GetDCEx
• 0x4745c4 GetDC
• 0x4745c8 GetCursorPos
• 0x4745cc GetCursor
• 0x4745d0 GetClientRect
• 0x4745d4 GetClassNameA
• 0x4745d8 GetClassInfoA
• 0x4745dc GetCapture
• 0x4745e0 GetActiveWindow
• 0x4745e4 FrameRect
• 0x4745e8 FindWindowA
• 0x4745ec FillRect
• 0x4745f0 EqualRect
• 0x4745f4 EnumWindows
• 0x4745f8 EnumThreadWindows
• 0x4745fc EndPaint
• 0x474600 EnableWindow
• 0x474604 EnableScrollBar
• 0x474608 EnableMenuItem
• 0x47460c DrawTextA
• 0x474610 DrawMenuBar
• 0x474614 DrawIconEx
• 0x474618 DrawIcon
• 0x47461c DrawFrameControl
• 0x474620 DrawFocusRect
• 0x474624 DrawEdge
• 0x474628 DispatchMessageA
• 0x47462c DestroyWindow
• 0x474630 DestroyMenu
• 0x474634 DestroyIcon
• 0x474638 DestroyCursor
• 0x47463c DeleteMenu
• 0x474640 DefWindowProcA
• 0x474644 DefMDIChildProcA
• 0x474648 DefFrameProcA
• 0x47464c CreatePopupMenu
• 0x474650 CreateMenu
• 0x474654 CreateIcon
• 0x474658 ClientToScreen
• 0x47465c CheckMenuItem
• 0x474660 CallWindowProcA
• 0x474664 CallNextHookEx
• 0x474668 BeginPaint
• 0x47466c CharNextA
• 0x474670 CharLowerA
• 0x474674 CharToOemA
• 0x474678 AdjustWindowRectEx
Library kernel32.dll:
• 0x474684 Sleep
Library oleaut32.dll:
• 0x47468c SafeArrayPtrOfIndex
• 0x474690 SafeArrayGetUBound
• 0x474694 SafeArrayGetLBound
• 0x474698 SafeArrayCreate
• 0x47469c VariantChangeType
• 0x4746a0 VariantCopy
• 0x4746a4 VariantClear
• 0x4746a8 VariantInit
Library comctl32.dll:
• 0x4746b8 ImageList_Write
• 0x4746bc ImageList_Read
• 0x4746cc ImageList_DragMove
• 0x4746d0 ImageList_DragLeave
• 0x4746d4 ImageList_DragEnter
• 0x4746d8 ImageList_EndDrag
• 0x4746dc ImageList_BeginDrag
• 0x4746e0 ImageList_Remove
• 0x4746e4 ImageList_DrawEx
• 0x4746e8 ImageList_Replace
• 0x4746ec ImageList_Draw
• 0x4746fc ImageList_Add
• 0x474704 ImageList_Destroy
• 0x474708 ImageList_Create
• 0x47470c InitCommonControls
Library comdlg32.dll:
• 0x474714 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.