popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

[자문]북한 신형 자폭드론.msc

KeyLogger ScreenShot AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 12, 2024, 5:40 p.m. Sept. 12, 2024, 5:42 p.m.
Size 143.3KB
Type XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 391fa4e57f91e3422ef5d32523d4dfc7
SHA256 57e9b7d1c18684a4e8b3688c454e832833e063019ed808fd69186c4e20df930a
CRC32 4D9A35A8
ssdeep 192:wP3GHv0InqdSyui9B7IVal8NMS0nb8XaSISRPWlf6IroliI8RxkZkNxB9tdctj8T:V85IVaAMS0IAlfa1MSu
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2736
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004100000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff90000
process_handle: 0xffffffffffffffff
1 0 0
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Run a KeyLogger rule KeyLogger
CTX malware (ai score=89)
ALYac Trojan.Downloader.Agent.XML
VIPRE Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Arcabit Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
VirIT Trojan.MSC.Heur.A
BitDefender Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
MicroWorld-eScan Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Emsisoft Dump:Generic.MSC.Kimsuky.A.FFFFFFFE (B)
Ikarus Trojan-Downloader.XML.Agent
FireEye Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Google Detected
GData Dump:Generic.MSC.Kimsuky.A.FFFFFFFE
Process injection Process 2552 resumed a thread in remote process 2664
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000280
suspend_count: 1
process_identifier: 2664
1 0 0