popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

MMkNn.exe

RedLine Infostealer UltraVNC Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 6, 2023, 9:31 a.m. Nov. 6, 2023, 9:41 a.m.
Size 336.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 576ea37ddee70b9062761e4bcc0c6a64
SHA256 a3dddc51a8682f5f59d14b73f3f6298a3e42100adaa35f5f923f30d972522b3e
CRC32 80B4066A
ssdeep 3072:nDKW1LgppLRHMY0TBfJvjcTp5XQpv8sTfoQWN7qRp+Q48:nDKW1Lgbdl0TBBvjc/Qa2NCqm
PDB Path
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UltraVNC_Zero - UltraVNC
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
apps.identrust.com
A 121.254.136.9
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.18
23.67.53.17
transfer.sh
A 144.76.136.153
144.76.136.153
IP Address Status Action
121.254.136.9 Active Moloch
144.76.136.153 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006058f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006058f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00605938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00605938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: mmknn+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4516588
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 4
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4517872
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 207
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4521968
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 175
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4526064
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 143
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4530160
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 111
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4534256
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 79
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4538352
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 47
1 0 0

__exception__

 stacktrace: 
mmknn+0xf054 @ 0x40f054
mmknn+0xf0a0 @ 0x40f0a0
mmknn+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 10 66 0f 7f 47 20 66 0f 7f 47 30 66
exception.symbol: mmknn+0xefeb
exception.address: 0x40efeb
exception.module: MMkNn.exe
exception.exception_code: 0xc0000005
exception.offset: 61419
registers.esp: 1636940
registers.edi: 4542448
registers.eax: 4516592
registers.ebp: 1636944
registers.edx: 112
registers.ebx: 0
registers.esi: 32647928
registers.ecx: 15
1 0 0
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02150000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00510000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02320000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00511000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00513000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0050c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00514000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00567000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00565000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00556000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0050a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Bkav W32.Common.DFEB8DE9
Lionic Trojan.Win32.CoinMiner.4!c
DrWeb Trojan.DownLoaderNET.447
MicroWorld-eScan Trojan.GenericKD.70152029
CAT-QuickHeal Trojan.CoinMiner
Skyhigh Artemis!Trojan
McAfee Artemis!576EA37DDEE7
Malwarebytes Trojan.MalPack
VIPRE Trojan.GenericKD.70152029
Sangfor Downloader.Win32.Agent.V8ua
K7AntiVirus Trojan-Downloader ( 0059a7a71 )
Alibaba Trojan:Win32/CoinMiner.00152d1c
K7GW Trojan-Downloader ( 0059a7a71 )
Cybereason malicious.4a57fd
BitDefenderTheta Gen:NN.ZexaF.36792.vq2@aWo3Ufg
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.NEH
Kaspersky Trojan.Win32.CoinMiner.apxd
BitDefender Trojan.GenericKD.70152029
NANO-Antivirus Trojan.Win32.CoinMiner.kdbarp
Rising Trojan.Generic@AI.100 (RDML:h8mjf3uOadehIlzSZwmJBg)
Emsisoft Trojan.GenericKD.70152029 (B)
F-Secure Trojan.TR/Dropper.MSIL.Gen
TrendMicro TrojanSpy.Win32.REDLINE.YXDKAZ
Trapmine suspicious.low.ml.score
FireEye Generic.mg.576ea37ddee70b90
Sophos Mal/Generic-S
Ikarus Trojan-Downloader.Agent
GData Trojan.GenericKD.70152029
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Dropper.MSIL.Gen
Varist W32/ABRisk.JHRO-3923
Kingsoft malware.kb.a.985
Gridinsoft Trojan.Win32.CoinMiner.sa
Arcabit Trojan.Generic.D42E6F5D
ZoneAlarm Trojan.Win32.CoinMiner.apxd
Microsoft Trojan:Win32/Leonem
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C5536053
VBA32 Trojan.CoinMiner
ALYac Trojan.GenericKD.70152029
MAX malware (ai score=86)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win32.REDLINE.YXDKAZ
Tencent Malware.Win32.Gencirc.13f3f8f7
Yandex Trojan.Igent.b07X2Q.17