popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kkm_2245.exe

.NET framework(MSIL) Malicious Library UPX ftp Lnk Format GIF Format .NET DLL PNG Format PE File DLL OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 2, 2024, 7:38 a.m. Jan. 2, 2024, 7:44 a.m.
Size 1.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 8c1279098d87e19ccc488a4b04a77e45
SHA256 1f0c96d7ee0d9664c0085394604a9137abc292a52c871f4bc3b5245627961573
CRC32 391F0C6A
ssdeep 24576:XMljQk33d4AGvpblCh8ynFNCJRkjFdOdqj1xCjBTXaUbydn8yePX78ESo:0l+AM9lChxaJ2jTj1Mj5Rydn8Oo
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMCommon.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk
file C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkovMessages.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\listen_access.cmd
file C:\Users\test22\AppData\Roaming\KkmAgent\NLog.dll
file C:\Users\test22\AppData\Local\Temp\nsnEDBC.tmp\nsProcess.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\PilotNtSharp.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk
file C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMCommon.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkovMessages.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\PilotNtSharp.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll
file C:\Users\test22\AppData\Local\Temp\nsnEDBC.tmp\nsProcess.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\NLog.dll
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\KKMAgent reg_value C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
Bkav W32.AIDetectMalware
Skyhigh BehavesLike.Win32.Dropper.tc
Cybereason malicious.84695c
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Startun.gen
Avast FileRepMalware [Misc]
Trapmine malicious.high.ml.score
FireEye Generic.mg.8c1279098d87e19c
SentinelOne Static AI - Malicious PE
Kingsoft Win32.Trojan.Startun.gen
ZoneAlarm HEUR:Trojan.Win32.Startun.gen
McAfee Artemis!8C1279098D87
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)