7.2
高危
59 个模型检测该样本为恶意！
重新分析
更多

2a51dc72b480d943f292ef6137a3d864ac85fec1d59632c52d12636b7285bee9

f1c2c21ef5ae1f6eb431800b21f60cb5.exe

分析耗时

105s

最近分析

文件大小

867.5KB
静态报毒 动态报毒 2GW@ASJYMFII AI SCORE=83 AIDETECTVM BESOPPLDJT8 CLASSIC CONFIDENCE DELF DELPHILESS EDDI ELDORADO ELZG EMHC FAREIT FORMBOOK GENETIC HIGH CONFIDENCE HKOMRH KRYPTIK MALWARE2 MALWARE@#14ZTJE5NQLECV MZMUU NANOCORE R + MAL R06EC0DIA20 REMCOS SCORE STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!F1C2C21EF5AE 20201227 6.0.6.653
Alibaba Trojan:Win32/FormBook.00014d25 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201228 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Eddi 20201228 1.0.0.1
Kingsoft 20201228 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (12 个事件)
Time & API Arguments Status Return Repeated
1620007532.899999
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda514ad
success 0 0
1620007541.149999
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdab14ad
success 0 0
1620007548.634626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750be97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750bea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750bb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750bb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750bac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750baed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750b5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750b559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdce14ad
success 0 0
1620007554.118499
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5514ad
success 0 0
1620007559.353501
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750be97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750bea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750bb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750bb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750bac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750baed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750b5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750b559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4514ad
success 0 0
1620007566.729249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3914ad
success 0 0
1620007572.431999
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3914ad
success 0 0
1620007578.009501
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x751c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x751c4de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd9514ad
success 0 0
1620007582.618374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7510e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7510ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7510b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7510b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7510ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7510aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75105511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7510559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5214ad
success 0 0
1620007587.493374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750be97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750bea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750bb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750bb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750bac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750baed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750b5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750b559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfddb14ad
success 0 0
1620007592.774626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x749ee97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x749eea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x749eb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x749eb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x749eac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x749eaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x749e5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x749e559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdab14ad
success 0 0
1620007599.712374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x749ee97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x749eea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x749eb25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x749eb4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x749eac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x749eaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x749e5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x749e559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75127f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75124de3
f1c2c21ef5ae1f6eb431800b21f60cb5+0x42a4d @ 0x442a4d
f1c2c21ef5ae1f6eb431800b21f60cb5+0x3b254 @ 0x43b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdaa14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 396 个事件)
Time & API Arguments Status Return Repeated
1619999682.385972
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619999682.495972
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619999682.510972
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e40000
success 0 0
1620007531.118999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620007531.259999
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e60000
success 0 0
1620007531.259999
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02040000
success 0 0
1620007531.259999
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 237568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00620000
success 0 0
1620007531.274999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00622000
success 0 0
1620007531.696999
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02080000
success 0 0
1620007531.696999
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02220000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.853999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004f2000
success 0 0
1620007532.868999
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007531.306374
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c0000
success 0 0
1620007531.368374
NtProtectVirtualMemory
process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1620007531.368374
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020d0000
success 0 0
1620007539.087874
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1620007539.165874
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1620007539.165874
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f90000
success 0 0
1620007540.790999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620007540.821999
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00510000
success 0 0
1620007540.821999
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00510000
success 0 0
1620007540.821999
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 237568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1620007540.821999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620007540.868999
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1620007540.868999
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f20000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620007541.118999
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 54 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.1636426578434715 section {'size_of_data': '0x00072800', 'virtual_address': '0x0006d000', 'entropy': 7.1636426578434715, 'name': '.rsrc', 'virtual_size': '0x00072670'} description A section with a high entropy has been found
entropy 0.5285631852279284 description Overall entropy of this PE file is high
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (23 个事件)
Time & API Arguments Status Return Repeated
1619999682.526972
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x000000f8
process_identifier: 2344
failed 0 0
1620007538.665374
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x000001e8
process_identifier: 2064
failed 0 0
1620007539.181874
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2668
failed 0 0
1620007544.540749
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000124
process_identifier: 912
failed 0 0
1620007546.181874
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 732
failed 0 0
1620007551.899499
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000148
process_identifier: 1320
failed 0 0
1620007552.571501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 420
failed 0 0
1620007556.384374
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000118
process_identifier: 2964
failed 0 0
1620007557.665999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3156
failed 0 0
1620007563.009374
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000158
process_identifier: 3232
failed 0 0
1620007563.712749
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3536
failed 0 0
1620007570.196501
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000160
process_identifier: 3668
failed 0 0
1620007570.696874
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3828
failed 0 0
1620007575.869124
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000144
process_identifier: 3916
failed 0 0
1620007576.509999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 4076
failed 0 0
1620007580.571749
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000134
process_identifier: 3148
failed 0 0
1620007581.259874
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 176
failed 0 0
1620007584.868374
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x00000118
process_identifier: 3600
failed 0 0
1620007585.400249
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3652
failed 0 0
1620007590.274999
Process32NextW
process_name: f1c2c21ef5ae1f6eb431800b21f60cb5.exe
snapshot_handle: 0x0000013c
process_identifier: 3740
failed 0 0
1620007591.165874
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f8
process_identifier: 2516
failed 0 0
1620007597.462749
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x00000148
process_identifier: 3968
failed 0 0
1620007598.385249
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3496
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (24 个事件)
Process injection Process 2344 called NtSetContextThread to modify thread in remote process 2616
Process injection Process 2080 called NtSetContextThread to modify thread in remote process 1804
Process injection Process 2244 called NtSetContextThread to modify thread in remote process 2448
Process injection Process 2560 called NtSetContextThread to modify thread in remote process 1816
Process injection Process 3100 called NtSetContextThread to modify thread in remote process 3172
Process injection Process 3480 called NtSetContextThread to modify thread in remote process 3568
Process injection Process 3776 called NtSetContextThread to modify thread in remote process 3852
Process injection Process 4024 called NtSetContextThread to modify thread in remote process 2648
Process injection Process 3268 called NtSetContextThread to modify thread in remote process 3260
Process injection Process 3772 called NtSetContextThread to modify thread in remote process 3648
Process injection Process 3952 called NtSetContextThread to modify thread in remote process 4016
Process injection Process 3932 called NtSetContextThread to modify thread in remote process 3316
Time & API Arguments Status Return Repeated
1619999683.291972
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2616
success 0 0
1620007539.509874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1804
success 0 0
1620007547.087874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2448
success 0 0
1620007552.978501
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1816
success 0 0
1620007558.134999
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3172
success 0 0
1620007564.603749
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3568
success 0 0
1620007571.259874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3852
success 0 0
1620007576.821999
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2648
success 0 0
1620007581.462874
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3260
success 0 0
1620007586.385249
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3648
success 0 0
1620007591.524874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4016
success 0 0
1620007598.947249
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3316
success 0 0
Expresses interest in specific running processes (2 个事件)
process: potential cuckoo sandbox detection pythonw.exe
process f1c2c21ef5ae1f6eb431800b21f60cb5.exe
Resumed a suspended thread in a remote process potentially indicative of process injection (24 个事件)
Process injection Process 2344 resumed a thread in remote process 2616
Process injection Process 2080 resumed a thread in remote process 1804
Process injection Process 2244 resumed a thread in remote process 2448
Process injection Process 2560 resumed a thread in remote process 1816
Process injection Process 3100 resumed a thread in remote process 3172
Process injection Process 3480 resumed a thread in remote process 3568
Process injection Process 3776 resumed a thread in remote process 3852
Process injection Process 4024 resumed a thread in remote process 2648
Process injection Process 3268 resumed a thread in remote process 3260
Process injection Process 3772 resumed a thread in remote process 3648
Process injection Process 3952 resumed a thread in remote process 4016
Process injection Process 3932 resumed a thread in remote process 3316
Time & API Arguments Status Return Repeated
1619999683.823972
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2616
success 0 0
1620007540.259874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1804
success 0 0
1620007547.618874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2448
success 0 0
1620007553.399501
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1816
success 0 0
1620007558.774999
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3172
success 0 0
1620007565.806749
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3568
success 0 0
1620007571.774874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3852
success 0 0
1620007577.337999
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2648
success 0 0
1620007581.978874
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 3260
success 0 0
1620007586.885249
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3648
success 0 0
1620007592.196874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 4016
success 0 0
1620007599.244249
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3316
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 95 个事件)
Time & API Arguments Status Return Repeated
1619999683.213972
CreateProcessInternalW
thread_identifier: 912
thread_handle: 0x000000fc
process_identifier: 2616
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619999683.213972
NtUnmapViewOfSection
process_identifier: 2616
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619999683.213972
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2616
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1619999683.291972
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619999683.291972
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2616
success 0 0
1619999683.823972
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2616
success 0 0
1619999683.870972
CreateProcessInternalW
thread_identifier: 1060
thread_handle: 0x00000104
process_identifier: 2064
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 2616 15687953
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007538.837374
CreateProcessInternalW
thread_identifier: 2636
thread_handle: 0x000001ec
process_identifier: 2080
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001f0
inherit_handles: 0
success 1 0
1620007539.478874
CreateProcessInternalW
thread_identifier: 1320
thread_handle: 0x000000fc
process_identifier: 1804
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007539.478874
NtUnmapViewOfSection
process_identifier: 1804
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007539.478874
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1804
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1620007539.509874
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007539.509874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1804
success 0 0
1620007540.259874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1804
success 0 0
1620007541.212874
CreateProcessInternalW
thread_identifier: 2868
thread_handle: 0x00000104
process_identifier: 912
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 1804 15697281
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007545.165749
CreateProcessInternalW
thread_identifier: 2364
thread_handle: 0x00000128
process_identifier: 2244
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000012c
inherit_handles: 0
success 1 0
1620007546.962874
CreateProcessInternalW
thread_identifier: 1816
thread_handle: 0x000000fc
process_identifier: 2448
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007546.962874
NtUnmapViewOfSection
process_identifier: 2448
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007546.993874
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2448
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1620007547.087874
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007547.087874
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2448
success 0 0
1620007547.618874
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2448
success 0 0
1620007547.899874
CreateProcessInternalW
thread_identifier: 2868
thread_handle: 0x00000104
process_identifier: 1320
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 2448 15704640
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007552.103499
CreateProcessInternalW
thread_identifier: 2948
thread_handle: 0x0000014c
process_identifier: 2560
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
1620007552.946501
CreateProcessInternalW
thread_identifier: 2604
thread_handle: 0x000000fc
process_identifier: 1816
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007552.946501
NtUnmapViewOfSection
process_identifier: 1816
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007552.946501
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1816
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1620007552.978501
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007552.978501
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1816
success 0 0
1620007553.399501
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1816
success 0 0
1620007554.212501
CreateProcessInternalW
thread_identifier: 3000
thread_handle: 0x00000104
process_identifier: 2964
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 1816 15710421
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007556.853374
CreateProcessInternalW
thread_identifier: 3104
thread_handle: 0x0000011c
process_identifier: 3100
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1620007558.056999
CreateProcessInternalW
thread_identifier: 3176
thread_handle: 0x000000fc
process_identifier: 3172
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007558.056999
NtUnmapViewOfSection
process_identifier: 3172
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007558.056999
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3172
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1620007558.134999
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007558.134999
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3172
success 0 0
1620007558.774999
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3172
success 0 0
1620007559.149999
CreateProcessInternalW
thread_identifier: 3236
thread_handle: 0x00000104
process_identifier: 3232
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 3172 15715796
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007563.071374
CreateProcessInternalW
thread_identifier: 3484
thread_handle: 0x0000015c
process_identifier: 3480
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000160
inherit_handles: 0
success 1 0
1620007564.540749
CreateProcessInternalW
thread_identifier: 3572
thread_handle: 0x000000fc
process_identifier: 3568
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007564.540749
NtUnmapViewOfSection
process_identifier: 3568
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620007564.540749
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3568
commit_size: 536576
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 536576
base_address: 0x00400000
success 0 0
1620007564.587749
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620007564.603749
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4723968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3568
success 0 0
1620007565.806749
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3568
success 0 0
1620007565.853749
CreateProcessInternalW
thread_identifier: 3672
thread_handle: 0x00000104
process_identifier: 3668
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe" 2 3568 15722828
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1620007570.306501
CreateProcessInternalW
thread_identifier: 3780
thread_handle: 0x00000164
process_identifier: 3776
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000168
inherit_handles: 0
success 1 0
1620007571.228874
CreateProcessInternalW
thread_identifier: 3856
thread_handle: 0x000000fc
process_identifier: 3852
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f1c2c21ef5ae1f6eb431800b21f60cb5.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620007571.228874
NtUnmapViewOfSection
process_identifier: 3852
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.10
FireEye Generic.mg.f1c2c21ef5ae1f6e
CAT-QuickHeal Trojan.Kryptik
McAfee Fareit-FTB!F1C2C21EF5AE
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056739d1 )
Alibaba Trojan:Win32/FormBook.00014d25
K7GW Trojan ( 0056739d1 )
Arcabit Trojan.Delf.FareIt.Gen.10
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Dropper.Remcos-7878921-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.10
NANO-Antivirus Trojan.Win32.Nanocore.hkomrh
Paloalto generic.ml
ViRobot Trojan.Win32.Z.Injector.888320.AT
Tencent Win32.Trojan.Kryptik.Eddi
Ad-Aware Trojan.Delf.FareIt.Gen.10
Emsisoft Trojan.Delf.FareIt.Gen.10 (B)
Comodo Malware@#14ztje5nqlecv
F-Secure Trojan.TR/Injector.mzmuu
DrWeb Trojan.Nanocore.23
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R06EC0DIA20
McAfee-GW-Edition BehavesLike.Win32.Fareit.cc
Sophos Mal/Generic-R + Mal/Fareit-AA
SentinelOne Static AI - Suspicious PE
Avira TR/Injector.mzmuu
Antiy-AVL Trojan/Win32.Wacatac
Microsoft PWS:Win32/Fareit.AKK!MTB
AegisLab Trojan.Win32.Malicious.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.10
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34700.2GW@aSJYmFii
ALYac Trojan.Delf.FareIt.Gen.10
MAX malware (ai score=83)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91342
ESET-NOD32 a variant of Win32/Injector.EMHC
TrendMicro-HouseCall TROJ_GEN.R06EC0DIA20
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46113c VirtualFree
• 0x461140 VirtualAlloc
• 0x461144 LocalFree
• 0x461148 LocalAlloc
• 0x46114c GetVersion
• 0x461150 GetCurrentThreadId
• 0x46115c VirtualQuery
• 0x461160 WideCharToMultiByte
• 0x461164 MultiByteToWideChar
• 0x461168 lstrlenA
• 0x46116c lstrcpynA
• 0x461170 LoadLibraryExA
• 0x461174 GetThreadLocale
• 0x461178 GetStartupInfoA
• 0x46117c GetProcAddress
• 0x461180 GetModuleHandleA
• 0x461184 GetModuleFileNameA
• 0x461188 GetLocaleInfoA
• 0x46118c GetCommandLineA
• 0x461190 FreeLibrary
• 0x461194 FindFirstFileA
• 0x461198 FindClose
• 0x46119c ExitProcess
• 0x4611a0 WriteFile
• 0x4611a8 RtlUnwind
• 0x4611ac RaiseException
• 0x4611b0 GetStdHandle
Library user32.dll:
• 0x4611b8 GetKeyboardType
• 0x4611bc LoadStringA
• 0x4611c0 MessageBoxA
• 0x4611c4 CharNextA
Library advapi32.dll:
• 0x4611cc RegQueryValueExA
• 0x4611d0 RegOpenKeyExA
• 0x4611d4 RegCloseKey
Library oleaut32.dll:
• 0x4611dc SysFreeString
• 0x4611e0 SysReAllocStringLen
• 0x4611e4 SysAllocStringLen
Library kernel32.dll:
• 0x4611ec TlsSetValue
• 0x4611f0 TlsGetValue
• 0x4611f4 LocalAlloc
• 0x4611f8 GetModuleHandleA
Library advapi32.dll:
• 0x461200 RegQueryValueExA
• 0x461204 RegOpenKeyExA
• 0x461208 RegCloseKey
Library kernel32.dll:
• 0x461210 lstrcpyA
• 0x461214 WriteFile
• 0x46121c WaitForSingleObject
• 0x461220 VirtualQuery
• 0x461224 VirtualAlloc
• 0x461228 Sleep
• 0x46122c SizeofResource
• 0x461230 SetThreadLocale
• 0x461234 SetFilePointer
• 0x461238 SetEvent
• 0x46123c SetErrorMode
• 0x461240 SetEndOfFile
• 0x461244 ResetEvent
• 0x461248 ReadFile
• 0x46124c MulDiv
• 0x461250 LockResource
• 0x461254 LoadResource
• 0x461258 LoadLibraryA
• 0x461264 GlobalUnlock
• 0x461268 GlobalReAlloc
• 0x46126c GlobalHandle
• 0x461270 GlobalLock
• 0x461274 GlobalFree
• 0x461278 GlobalFindAtomA
• 0x46127c GlobalDeleteAtom
• 0x461280 GlobalAlloc
• 0x461284 GlobalAddAtomA
• 0x461288 GetVersionExA
• 0x46128c GetVersion
• 0x461290 GetTickCount
• 0x461294 GetThreadLocale
• 0x46129c GetSystemTime
• 0x4612a0 GetSystemInfo
• 0x4612a4 GetStringTypeExA
• 0x4612a8 GetStdHandle
• 0x4612ac GetProcAddress
• 0x4612b0 GetModuleHandleA
• 0x4612b4 GetModuleFileNameA
• 0x4612b8 GetLocaleInfoA
• 0x4612bc GetLocalTime
• 0x4612c0 GetLastError
• 0x4612c4 GetFullPathNameA
• 0x4612c8 GetDiskFreeSpaceA
• 0x4612cc GetDateFormatA
• 0x4612d0 GetCurrentThreadId
• 0x4612d4 GetCurrentProcessId
• 0x4612d8 GetCPInfo
• 0x4612dc GetACP
• 0x4612e0 FreeResource
• 0x4612e4 InterlockedExchange
• 0x4612e8 FreeLibrary
• 0x4612ec FormatMessageA
• 0x4612f0 FindResourceA
• 0x4612f4 ExitThread
• 0x4612f8 EnumCalendarInfoA
• 0x461304 CreateThread
• 0x461308 CreateFileA
• 0x46130c CreateEventA
• 0x461310 CompareStringA
• 0x461314 CloseHandle
Library version.dll:
• 0x46131c VerQueryValueA
• 0x461324 GetFileVersionInfoA
Library gdi32.dll:
• 0x46132c UnrealizeObject
• 0x461330 StretchBlt
• 0x461334 SetWindowOrgEx
• 0x461338 SetViewportOrgEx
• 0x46133c SetTextColor
• 0x461340 SetStretchBltMode
• 0x461344 SetROP2
• 0x461348 SetPixel
• 0x46134c SetDIBColorTable
• 0x461350 SetBrushOrgEx
• 0x461354 SetBkMode
• 0x461358 SetBkColor
• 0x46135c SelectPalette
• 0x461360 SelectObject
• 0x461364 SelectClipPath
• 0x461368 SaveDC
• 0x46136c RestoreDC
• 0x461370 RectVisible
• 0x461374 RealizePalette
• 0x461378 PatBlt
• 0x46137c MoveToEx
• 0x461380 MaskBlt
• 0x461384 LineTo
• 0x461388 IntersectClipRect
• 0x46138c GetWindowOrgEx
• 0x461390 GetTextMetricsA
• 0x46139c GetStockObject
• 0x4613a0 GetPixel
• 0x4613a4 GetPaletteEntries
• 0x4613a8 GetObjectA
• 0x4613ac GetDeviceCaps
• 0x4613b0 GetDIBits
• 0x4613b4 GetDIBColorTable
• 0x4613b8 GetDCOrgEx
• 0x4613c0 GetClipBox
• 0x4613c4 GetBrushOrgEx
• 0x4613c8 GetBitmapBits
• 0x4613cc ExcludeClipRect
• 0x4613d0 DeleteObject
• 0x4613d4 DeleteDC
• 0x4613d8 CreateSolidBrush
• 0x4613dc CreatePenIndirect
• 0x4613e0 CreatePalette
• 0x4613e8 CreateFontIndirectA
• 0x4613ec CreateDIBitmap
• 0x4613f0 CreateDIBSection
• 0x4613f4 CreateCompatibleDC
• 0x4613fc CreateBrushIndirect
• 0x461400 CreateBitmap
• 0x461404 BitBlt
Library user32.dll:
• 0x46140c CreateWindowExA
• 0x461410 WindowFromPoint
• 0x461414 WinHelpA
• 0x461418 WaitMessage
• 0x46141c UpdateWindow
• 0x461420 UnregisterClassA
• 0x461424 UnhookWindowsHookEx
• 0x461428 TranslateMessage
• 0x461430 TrackPopupMenu
• 0x461438 ShowWindow
• 0x46143c ShowScrollBar
• 0x461440 ShowOwnedPopups
• 0x461444 ShowCursor
• 0x461448 SetWindowsHookExA
• 0x46144c SetWindowPos
• 0x461450 SetWindowPlacement
• 0x461454 SetWindowLongA
• 0x461458 SetTimer
• 0x46145c SetScrollRange
• 0x461460 SetScrollPos
• 0x461464 SetScrollInfo
• 0x461468 SetRect
• 0x46146c SetPropA
• 0x461470 SetParent
• 0x461474 SetMenuItemInfoA
• 0x461478 SetMenu
• 0x46147c SetForegroundWindow
• 0x461480 SetFocus
• 0x461484 SetCursor
• 0x461488 SetClassLongA
• 0x46148c SetCapture
• 0x461490 SetActiveWindow
• 0x461494 SendMessageA
• 0x461498 ScrollWindow
• 0x46149c ScreenToClient
• 0x4614a0 RemovePropA
• 0x4614a4 RemoveMenu
• 0x4614a8 ReleaseDC
• 0x4614ac ReleaseCapture
• 0x4614b8 RegisterClassA
• 0x4614bc RedrawWindow
• 0x4614c0 PtInRect
• 0x4614c4 PostQuitMessage
• 0x4614c8 PostMessageA
• 0x4614cc PeekMessageA
• 0x4614d0 OffsetRect
• 0x4614d4 OemToCharA
• 0x4614d8 MessageBoxA
• 0x4614dc MapWindowPoints
• 0x4614e0 MapVirtualKeyA
• 0x4614e4 LoadStringA
• 0x4614e8 LoadKeyboardLayoutA
• 0x4614ec LoadIconA
• 0x4614f0 LoadCursorA
• 0x4614f4 LoadBitmapA
• 0x4614f8 KillTimer
• 0x4614fc IsZoomed
• 0x461500 IsWindowVisible
• 0x461504 IsWindowEnabled
• 0x461508 IsWindow
• 0x46150c IsRectEmpty
• 0x461510 IsIconic
• 0x461514 IsDialogMessageA
• 0x461518 IsChild
• 0x46151c InvalidateRect
• 0x461520 IntersectRect
• 0x461524 InsertMenuItemA
• 0x461528 InsertMenuA
• 0x46152c InflateRect
• 0x461534 GetWindowTextA
• 0x461538 GetWindowRect
• 0x46153c GetWindowPlacement
• 0x461540 GetWindowLongA
• 0x461544 GetWindowDC
• 0x461548 GetTopWindow
• 0x46154c GetSystemMetrics
• 0x461550 GetSystemMenu
• 0x461554 GetSysColorBrush
• 0x461558 GetSysColor
• 0x46155c GetSubMenu
• 0x461560 GetScrollRange
• 0x461564 GetScrollPos
• 0x461568 GetScrollInfo
• 0x46156c GetPropA
• 0x461570 GetParent
• 0x461574 GetWindow
• 0x461578 GetMenuStringA
• 0x46157c GetMenuState
• 0x461580 GetMenuItemInfoA
• 0x461584 GetMenuItemID
• 0x461588 GetMenuItemCount
• 0x46158c GetMenu
• 0x461590 GetLastActivePopup
• 0x461594 GetKeyboardState
• 0x46159c GetKeyboardLayout
• 0x4615a0 GetKeyState
• 0x4615a4 GetKeyNameTextA
• 0x4615a8 GetIconInfo
• 0x4615ac GetForegroundWindow
• 0x4615b0 GetFocus
• 0x4615b4 GetDlgItem
• 0x4615b8 GetDesktopWindow
• 0x4615bc GetDCEx
• 0x4615c0 GetDC
• 0x4615c4 GetCursorPos
• 0x4615c8 GetCursor
• 0x4615cc GetClientRect
• 0x4615d0 GetClassNameA
• 0x4615d4 GetClassInfoA
• 0x4615d8 GetCapture
• 0x4615dc GetActiveWindow
• 0x4615e0 FrameRect
• 0x4615e4 FindWindowA
• 0x4615e8 FillRect
• 0x4615ec EqualRect
• 0x4615f0 EnumWindows
• 0x4615f4 EnumThreadWindows
• 0x4615f8 EndPaint
• 0x4615fc EnableWindow
• 0x461600 EnableScrollBar
• 0x461604 EnableMenuItem
• 0x461608 DrawTextA
• 0x46160c DrawMenuBar
• 0x461610 DrawIconEx
• 0x461614 DrawIcon
• 0x461618 DrawFrameControl
• 0x46161c DrawFocusRect
• 0x461620 DrawEdge
• 0x461624 DispatchMessageA
• 0x461628 DestroyWindow
• 0x46162c DestroyMenu
• 0x461630 DestroyIcon
• 0x461634 DestroyCursor
• 0x461638 DeleteMenu
• 0x46163c DefWindowProcA
• 0x461640 DefMDIChildProcA
• 0x461644 DefFrameProcA
• 0x461648 CreatePopupMenu
• 0x46164c CreateMenu
• 0x461650 CreateIcon
• 0x461654 ClientToScreen
• 0x461658 CheckMenuItem
• 0x46165c CallWindowProcA
• 0x461660 CallNextHookEx
• 0x461664 BeginPaint
• 0x461668 CharNextA
• 0x46166c CharLowerA
• 0x461670 CharToOemA
• 0x461674 AdjustWindowRectEx
Library kernel32.dll:
• 0x461680 Sleep
Library oleaut32.dll:
• 0x461688 SafeArrayPtrOfIndex
• 0x46168c SafeArrayGetUBound
• 0x461690 SafeArrayGetLBound
• 0x461694 SafeArrayCreate
• 0x461698 VariantChangeType
• 0x46169c VariantCopy
• 0x4616a0 VariantClear
• 0x4616a4 VariantInit
Library comctl32.dll:
• 0x4616b4 ImageList_Write
• 0x4616b8 ImageList_Read
• 0x4616c8 ImageList_DragMove
• 0x4616cc ImageList_DragLeave
• 0x4616d0 ImageList_DragEnter
• 0x4616d4 ImageList_EndDrag
• 0x4616d8 ImageList_BeginDrag
• 0x4616dc ImageList_Remove
• 0x4616e0 ImageList_DrawEx
• 0x4616e4 ImageList_Draw
• 0x4616f4 ImageList_Add
• 0x4616fc ImageList_Destroy
• 0x461700 ImageList_Create
• 0x461704 InitCommonControls
Library comdlg32.dll:
• 0x46170c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.