popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kus.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 30, 2023, 12:52 p.m. Sept. 30, 2023, 12:56 p.m.
Size 246.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 acf39b9c0b1f3c9addd5dd50a8773a28
SHA256 f4f35abb06e0554b92554c8a10b7a0f9c60f5057bb71a931d444a0785929077a
CRC32 A989FB33
ssdeep 6144:yXtz4SHy5uoBMFGV5PEkIXEHvZAOuju3X1fcVs0BC+:lCmuoBMUOMxxus0BC+
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlDeleteAce+0xf RtlAddVectoredContinueHandler-0x122 ntdll+0x636bf @ 0x76f736bf
DeleteAce+0x11 GetAce-0x1a kernelbase+0x1c291 @ 0x7598c291
_LoadEnvironment@0+0x4f kus+0x700b @ 0xcd700b
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x76f52c36
registers.esp: 2029332
registers.edi: 1996554752
registers.eax: 2029376
registers.ebp: 2029392
registers.edx: 6
registers.ebx: 0
registers.esi: 0
registers.ecx: 13686656
1 0 0
section {u'size_of_data': u'0x00008800', u'virtual_address': u'0x00035000', u'entropy': 7.618359153334468, u'name': u'.data', u'virtual_size': u'0x00009634'} entropy 7.61835915333 description A section with a high entropy has been found
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000005
process_identifier: 2660
process_handle: 0x00000054
0 0

NtTerminateProcess

 status_code: 0x00000005
process_identifier: 2660
process_handle: 0x00000054
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000054
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000058
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Process injection Process 2548 manipulating memory of non-child process 2660
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000054
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2696
process_handle: 0x00000058
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2696
process_handle: 0x00000058
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2696
process_handle: 0x00000058
1 1 0
Process injection Process 2548 called NtSetContextThread to modify thread in remote process 2696
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3340580
registers.edi: 0
registers.eax: 4207172
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000005c
process_identifier: 2696
1 0 0
Process injection Process 2548 resumed a thread in remote process 2696
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000005c
suspend_count: 1
process_identifier: 2696
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2664
thread_handle: 0x0000002c
process_identifier: 2660
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000054
1 1 0

NtGetContextThread

 thread_handle: 0x0000002c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000054
3221225496 0

WriteProcessMemory

 buffer:
base_address: 0x00000000
process_identifier: 2660
process_handle: 0x00000054
0 0

CreateProcessInternalW

 thread_identifier: 2700
thread_handle: 0x0000005c
process_identifier: 2696
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000058
1 1 0

NtGetContextThread

 thread_handle: 0x0000005c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000058
1 0 0

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2696
process_handle: 0x00000058
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2696
process_handle: 0x00000058
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2696
process_handle: 0x00000058
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3340580
registers.edi: 0
registers.eax: 4207172
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000005c
process_identifier: 2696
1 0 0

NtResumeThread

 thread_handle: 0x0000005c
suspend_count: 1
process_identifier: 2696
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
VIPRE Gen:Variant.Lazy.397537
Cybereason malicious.e02ef9
Arcabit Trojan.Lazy.D610E1
Cyren W32/Kryptik.KSI.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HUQK
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Injurer.gen
BitDefender Gen:Variant.Lazy.397537
MicroWorld-eScan Gen:Variant.Lazy.397537
Avast Win32:PWSX-gen [Trj]
DrWeb Trojan.Inject4.61510
TrendMicro TrojanSpy.Win32.TRICKBOT.SMC
Trapmine suspicious.low.ml.score
FireEye Generic.mg.acf39b9c0b1f3c9a
Emsisoft Gen:Variant.Lazy.397537 (B)
Ikarus Trojan.Win32.Crypt
Webroot
Microsoft Trojan:Win32/SmokeLoader.RB!MTB
ZoneAlarm VHO:Backdoor.Win32.Convagent.gen
GData Gen:Variant.Lazy.397537
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5302376
ALYac Gen:Variant.Lazy.397537
MAX malware (ai score=80)
Malwarebytes Trojan.MalPack.SAB.Generic
TrendMicro-HouseCall TrojanSpy.Win32.TRICKBOT.SMC
Rising Backdoor.Mokes!8.619 (TFE:5:cp4sb0ybDnO)
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HUQK!tr
BitDefenderTheta Gen:NN.ZexaF.36738.pqW@aOrRf0h
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (D)