popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

tus.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 26, 2023, 10:17 a.m. Oct. 26, 2023, 10:21 a.m.
Size 914.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 10a17abe9f1d739be062dfa9f1730298
SHA256 1fed84f709df74d68b6b899c01698daad2266a433ec956ba1656ed791f3fe2c8
CRC32 9F6D8BC1
ssdeep 12288:BO6tSZ29AzVvWD+wVLZ5D4bzdKhvixnC7vuZf/60h6DPqY1R:Ba29AzVvWD+wVT4bzWKxG/q
PDB Path C:\21vdpnnvh\RevoInstall.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\21vdpnnvh\RevoInstall.pdb
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2112
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000003c
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2112
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2112
process_handle: 0x0000003c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2112
process_handle: 0x0000003c
1 1 0
Process injection Process 1200 called NtSetContextThread to modify thread in remote process 2112
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 2226956
registers.edi: 0
registers.eax: 4207172
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000038
process_identifier: 2112
1 0 0
Process injection Process 1200 resumed a thread in remote process 2112
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000038
suspend_count: 1
process_identifier: 2112
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2116
thread_handle: 0x00000038
process_identifier: 2112
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000003c
1 1 0

NtGetContextThread

 thread_handle: 0x00000038
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2112
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000003c
1 0 0

WriteProcessMemory

 buffer: MZ€ÿÿ@@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²ˆ™dà HvD2@õ.textytv à
base_address: 0x00400000
process_identifier: 2112
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2112
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2112
process_handle: 0x0000003c
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 2226956
registers.edi: 0
registers.eax: 4207172
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000038
process_identifier: 2112
1 0 0

NtResumeThread

 thread_handle: 0x00000038
suspend_count: 1
process_identifier: 2112
1 0 0
Bkav W32.AIDetectMalware
MicroWorld-eScan Gen:Trojan.Heur.JP.5yW@amESq5n
ClamAV Win.Packed.Pwsx-10012424-0
Skyhigh BehavesLike.Win32.Smokeloader.dm
ALYac Gen:Trojan.Heur.JP.5yW@amESq5n
BitDefender Gen:Trojan.Heur.JP.5yW@amESq5n
CrowdStrike win/malicious_confidence_60% (D)
BitDefenderTheta AI:Packer.B8AF99D91E
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HUYH
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan-PSW.Win32.Convagent.gen
Rising Trojan.SmokeLoader!1.EB50 (CLASSIC)
VIPRE Gen:Trojan.Heur.JP.5yW@amESq5n
FireEye Gen:Trojan.Heur.JP.5yW@amESq5n
Emsisoft Gen:Trojan.Heur.JP.5yW@amESq5n (B)
Ikarus Trojan.Win32.Redline
GData Gen:Trojan.Heur.JP.5yW@amESq5n
Google Detected
Arcabit Trojan.Heur.JP.EEC35F
ZoneAlarm VHO:Trojan-PSW.Win32.Convagent.gen
Microsoft Program:Win32/Wacapew.C!ml
Varist W32/Kryptik.KYF.gen!Eldorado
MAX malware (ai score=89)
DeepInstinct MALICIOUS
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HUKQ!tr
AVG CrypterX-gen [Trj]
Avast CrypterX-gen [Trj]