popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sn.exe

Generic Malware Admin Tool (Sysinternals etc ...) UPX Malicious Packer PE File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 20, 2023, 9:33 a.m. June 20, 2023, 9:35 a.m.
Size 5.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1a3c1fc575e887613a939ac922be008e
SHA256 c08717041abe9ab94e3923f4e08a09583ab195ac3d460642b18568362c32a71e
CRC32 763AFB4A
ssdeep 98304:Y99eu+2CsrmgBRcowzOCMOh7+HjCUPCS5AOoYSRVvpqWZ:4EsrmTTB5h7GCjYAO7SYWZ
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a
GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x75600d27
CallWindowProcA+0x1b GetClassNameA-0x95 user32+0x2794a @ 0x7560794a
sn+0x16a30f @ 0x56a30f
sn+0x169a06 @ 0x569a06
EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048
BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e
ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981
ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa
ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600
sn+0x19da @ 0x4019da
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: f3 a5 0b ca 75 05 5f 5e c2 0c 00 f3 a4 5f 5e c2
exception.symbol: RtlMoveMemory+0x1b RtlFindActivationContextSectionGuid-0x270 ntdll+0x63c5b
exception.instruction: movsd dword ptr es:[edi], dword ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 408667
exception.address: 0x77903c5b
registers.esp: 1636972
registers.edi: 6160384
registers.eax: 2005941312
registers.ebp: 1637176
registers.edx: 0
registers.ebx: 6784702
registers.esi: 3723846660
registers.ecx: 62
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00600000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00610000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003e0000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.472561
ClamAV Win.Dropper.QuasarRAT-10004400-0
McAfee GenericRXAA-AA!1A3C1FC575E8
Malwarebytes Trojan.Injector
Sangfor Dropper.Win32.Zusy.Vnaw
Alibaba TrojanSpy:Win32/Solmyr.99f731fb
K7GW Trojan ( 005a70951 )
VirIT Trojan.Win32.Genus.RFG
Cyren W32/ABSpyware.FFPR-0248
Symantec Trojan Horse
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Injector.BZOO
Cynet Malicious (score: 100)
Kaspersky Trojan-Spy.Win32.Solmyr.acq
BitDefender Gen:Variant.Zusy.472561
Avast Win32:RATX-gen [Trj]
Emsisoft Gen:Variant.Zusy.472561 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.VbCrypt.250
VIPRE Gen:Variant.Zusy.472561
TrendMicro TROJ_GEN.R014C0XFF23
McAfee-GW-Edition BehavesLike.Win32.Trojan.tc
FireEye Generic.mg.1a3c1fc575e88761
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
GData Gen:Variant.Zusy.472561
Avira TR/Dropper.Gen
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.BitRAT.bot
Xcitium Malware@#n4h6ishti7zx
Arcabit Trojan.Zusy.D735F1
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
VBA32 BScope.Trojan-Dropper.Injector
ALYac Gen:Variant.Zusy.472561
MAX malware (ai score=88)
Cylance unsafe
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_GEN.R014C0XFF23
Rising Trojan.JanaCrypter!1.E640 (CLASSIC)
Ikarus Trojan.Win32.Injector
Fortinet W32/BZOO!tr
BitDefenderTheta Gen:NN.ZevbaF.36250.@p3@ain2gNpi
AVG Win32:RATX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)