ScreenShot
| Created | 2023.09.25 07:39 | Machine | s1_win7_x6401 |
| Filename | kus.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 073e99375099253a97c86d972a82b344 | ||
| sha256 | 51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f | ||
| ssdeep | 6144:wRhhrJ+j+5j68KsT6h/OCy5U9uAOPArJuD8b7Uqw6:wRXN+j+5+RsqGGuWrJuDs7Fw6 | ||
| imphash | 8ddc982ec86bc15061e6b2eab1424dec | ||
| impfuzzy | 24:JNcpVWZjeDzGtXGhlJBl39RPLOovbO3kFZMv1GMAkEZHu9J:JNcpVejiGtXGnp3630FZGb | ||
Network IP location
Signature (10cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Code injection by writing an executable or DLL to the memory of another process |
| watch | Detects Avast Antivirus through the presence of a library |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | One or more potentially interesting buffers were extracted |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42a000 MultiByteToWideChar
0x42a004 GetStringTypeW
0x42a008 WideCharToMultiByte
0x42a00c CloseHandle
0x42a010 GetCurrentThreadId
0x42a014 EnterCriticalSection
0x42a018 LeaveCriticalSection
0x42a01c InitializeCriticalSectionEx
0x42a020 DeleteCriticalSection
0x42a024 EncodePointer
0x42a028 DecodePointer
0x42a02c LCMapStringEx
0x42a030 QueryPerformanceCounter
0x42a034 GetSystemTimeAsFileTime
0x42a038 GetModuleHandleW
0x42a03c GetProcAddress
0x42a040 GetCPInfo
0x42a044 IsProcessorFeaturePresent
0x42a048 GetCurrentProcessId
0x42a04c InitializeSListHead
0x42a050 IsDebuggerPresent
0x42a054 UnhandledExceptionFilter
0x42a058 SetUnhandledExceptionFilter
0x42a05c GetStartupInfoW
0x42a060 GetCurrentProcess
0x42a064 TerminateProcess
0x42a068 CreateFileW
0x42a06c RaiseException
0x42a070 RtlUnwind
0x42a074 GetLastError
0x42a078 SetLastError
0x42a07c InitializeCriticalSectionAndSpinCount
0x42a080 TlsAlloc
0x42a084 TlsGetValue
0x42a088 TlsSetValue
0x42a08c TlsFree
0x42a090 FreeLibrary
0x42a094 LoadLibraryExW
0x42a098 GetModuleHandleExW
0x42a09c GetStdHandle
0x42a0a0 WriteFile
0x42a0a4 GetModuleFileNameW
0x42a0a8 ExitProcess
0x42a0ac GetCommandLineA
0x42a0b0 GetCommandLineW
0x42a0b4 HeapAlloc
0x42a0b8 HeapFree
0x42a0bc CompareStringW
0x42a0c0 LCMapStringW
0x42a0c4 GetLocaleInfoW
0x42a0c8 IsValidLocale
0x42a0cc GetUserDefaultLCID
0x42a0d0 EnumSystemLocalesW
0x42a0d4 GetFileType
0x42a0d8 FlushFileBuffers
0x42a0dc GetConsoleOutputCP
0x42a0e0 GetConsoleMode
0x42a0e4 ReadFile
0x42a0e8 GetFileSizeEx
0x42a0ec SetFilePointerEx
0x42a0f0 ReadConsoleW
0x42a0f4 HeapReAlloc
0x42a0f8 FindClose
0x42a0fc FindFirstFileExW
0x42a100 FindNextFileW
0x42a104 IsValidCodePage
0x42a108 GetACP
0x42a10c GetOEMCP
0x42a110 GetEnvironmentStringsW
0x42a114 FreeEnvironmentStringsW
0x42a118 SetEnvironmentVariableW
0x42a11c SetStdHandle
0x42a120 GetProcessHeap
0x42a124 HeapSize
0x42a128 WriteConsoleW
EAT(Export Address Table) Library
0x402e30 _uSGyuTYAStyA@12
KERNEL32.dll
0x42a000 MultiByteToWideChar
0x42a004 GetStringTypeW
0x42a008 WideCharToMultiByte
0x42a00c CloseHandle
0x42a010 GetCurrentThreadId
0x42a014 EnterCriticalSection
0x42a018 LeaveCriticalSection
0x42a01c InitializeCriticalSectionEx
0x42a020 DeleteCriticalSection
0x42a024 EncodePointer
0x42a028 DecodePointer
0x42a02c LCMapStringEx
0x42a030 QueryPerformanceCounter
0x42a034 GetSystemTimeAsFileTime
0x42a038 GetModuleHandleW
0x42a03c GetProcAddress
0x42a040 GetCPInfo
0x42a044 IsProcessorFeaturePresent
0x42a048 GetCurrentProcessId
0x42a04c InitializeSListHead
0x42a050 IsDebuggerPresent
0x42a054 UnhandledExceptionFilter
0x42a058 SetUnhandledExceptionFilter
0x42a05c GetStartupInfoW
0x42a060 GetCurrentProcess
0x42a064 TerminateProcess
0x42a068 CreateFileW
0x42a06c RaiseException
0x42a070 RtlUnwind
0x42a074 GetLastError
0x42a078 SetLastError
0x42a07c InitializeCriticalSectionAndSpinCount
0x42a080 TlsAlloc
0x42a084 TlsGetValue
0x42a088 TlsSetValue
0x42a08c TlsFree
0x42a090 FreeLibrary
0x42a094 LoadLibraryExW
0x42a098 GetModuleHandleExW
0x42a09c GetStdHandle
0x42a0a0 WriteFile
0x42a0a4 GetModuleFileNameW
0x42a0a8 ExitProcess
0x42a0ac GetCommandLineA
0x42a0b0 GetCommandLineW
0x42a0b4 HeapAlloc
0x42a0b8 HeapFree
0x42a0bc CompareStringW
0x42a0c0 LCMapStringW
0x42a0c4 GetLocaleInfoW
0x42a0c8 IsValidLocale
0x42a0cc GetUserDefaultLCID
0x42a0d0 EnumSystemLocalesW
0x42a0d4 GetFileType
0x42a0d8 FlushFileBuffers
0x42a0dc GetConsoleOutputCP
0x42a0e0 GetConsoleMode
0x42a0e4 ReadFile
0x42a0e8 GetFileSizeEx
0x42a0ec SetFilePointerEx
0x42a0f0 ReadConsoleW
0x42a0f4 HeapReAlloc
0x42a0f8 FindClose
0x42a0fc FindFirstFileExW
0x42a100 FindNextFileW
0x42a104 IsValidCodePage
0x42a108 GetACP
0x42a10c GetOEMCP
0x42a110 GetEnvironmentStringsW
0x42a114 FreeEnvironmentStringsW
0x42a118 SetEnvironmentVariableW
0x42a11c SetStdHandle
0x42a120 GetProcessHeap
0x42a124 HeapSize
0x42a128 WriteConsoleW
EAT(Export Address Table) Library
0x402e30 _uSGyuTYAStyA@12