popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kz_kkm_2.4.2.3.exe

Generic Malware .NET framework(MSIL) Malicious Library UPX Malicious Packer Javascript_Blob Anti_VM ftp Lnk Format GIF Format PE64 .NET DLL PNG Format PE File DLL OS Processor Check PE32 .NET EXE wget
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 15, 2024, 4:37 p.m. July 15, 2024, 4:44 p.m.
Size 5.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 40a22356fd06bc9a4fd4ddedf5286666
SHA256 ae1a168ff481173d18034d14a767c0801458e95cc3016dc8d82212d0c083a474
CRC32 38F40D05
ssdeep 98304:NLIAMmuuNkfUo2EwVPBh4i02bt+xznOywv+r4oYIxu1i2e56SM2F9jE37HethOKd:WyNkfr29VPBhh0p5ngve4lIQe5UM9jqK
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004d60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Newtonsoft.Json.Bson.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.SwaggerUI.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\Microsoft.Diagnostics.Tracing.EventSource.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\ManagedOpenSsl.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Atol.Drivers10.Fptr.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\QRCoder.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\PilotNtSharp.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swagger.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.Newtonsoft.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\HtmlAgilityPack.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.AspNetCore.JsonPatch.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\libcrypto-3.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\KKMLib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swagger.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.OpenApi.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\NLog.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\NLog.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\api\RabbitMQ.Client.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\libssl-3.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.Swagger.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\SushkofWin32Lib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\HttpServer.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\DualConnector.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\KKMCommon.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMLib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.SwaggerGen.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.AspNetCore.Mvc.NewtonsoftJson.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\PilotNtSharp.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMCommon.dll
file C:\Users\test22\AppData\Local\Temp\nsxC158.tmp\nsProcess.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk
file C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.Diagnostics.Tracing.EventSource.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\BarcodeLib.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk
file C:\Users\test22\AppData\Roaming\KkmAgent\HttpServer.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.Swagger.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\libcrypto-3.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.OpenApi.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Newtonsoft.Json.Bson.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swagger.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\QRCoder.dll
file C:\Users\test22\AppData\Local\Temp\nsxC158.tmp\nsProcess.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\KKMCommon.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.SwaggerGen.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.Newtonsoft.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\NLog.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.Diagnostics.Tracing.EventSource.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\PilotNtSharp.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.AspNetCore.Mvc.NewtonsoftJson.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\KKMLib.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\HtmlAgilityPack.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Microsoft.AspNetCore.JsonPatch.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Swashbuckle.AspNetCore.SwaggerUI.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\api\Newtonsoft.Json.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\libssl-3.dll
file C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\KKMAgent reg_value C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Cylance Unsafe
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Scar.gen
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.40a22356fd06bc9a
Kingsoft malware.kb.a.864
ZoneAlarm HEUR:Trojan.Win32.Scar.gen
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1865480811