Edit tour

Windows Analysis Report
ZKNiiqoHKV.exe

Overview

General Information

Sample name:	ZKNiiqoHKV.exe renamed because original name is a hash value
Original sample name:	6bacbe921c817ef6fc3d2fa1b8cd100452d5f002bd76ce536632abc633f571ae.exe
Analysis ID:	1538056
MD5:	1169e07116b990459d7c3d52bc4f58fe
SHA1:	f4d6680399237143f914902bf7c8be0475589625
SHA256:	6bacbe921c817ef6fc3d2fa1b8cd100452d5f002bd76ce536632abc633f571ae
Tags:	exeuser-0xv
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

PE file contains section with special chars

Entry point lies outside standard sections

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

ZKNiiqoHKV.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\ZKNiiqoHKV.exe" MD5: 1169E07116B990459D7C3D52BC4F58FE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ZKNiiqoHKV.exe	ReversingLabs: Detection: 34%
Source: ZKNiiqoHKV.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.6% probability

Machine Learning detection for sample

Source: ZKNiiqoHKV.exe

Joe Sandbox ML: detected

System Summary

PE file contains section with special chars

Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:

Source: ZKNiiqoHKV.exe

Static PE information: Number of sections : 13 > 10

Source: ZKNiiqoHKV.exe, 00000000.00000002.2911223832.0000000141E04000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGunzLegacy.exe8 vs ZKNiiqoHKV.exe
Source: ZKNiiqoHKV.exe	Binary or memory string: OriginalFilenameGunzLegacy.exe8 vs ZKNiiqoHKV.exe

Source: ZKNiiqoHKV.exe	Static PE information: Section: ZLIB complexity 0.993994433008982
Source: ZKNiiqoHKV.exe	Static PE information: Section: ZLIB complexity 0.9973697916666666
Source: ZKNiiqoHKV.exe	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal60.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZKNiiqoHKV.exe	ReversingLabs: Detection: 34%
Source: ZKNiiqoHKV.exe	Virustotal: Detection: 51%

Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: d3dx9_43.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: fmod64.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZKNiiqoHKV.exe	Section loaded: wldp.dll	Jump to behavior

Source: ZKNiiqoHKV.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ZKNiiqoHKV.exe

Static file information: File size 6152208 > 1048576

Source: ZKNiiqoHKV.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x1fe000
Source: ZKNiiqoHKV.exe	Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x2ff400

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name:
Source: ZKNiiqoHKV.exe	Static PE information: section name: .themida
Source: ZKNiiqoHKV.exe	Static PE information: section name: .boot

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Software Packing	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZKNiiqoHKV.exe	34%	ReversingLabs	Win64.Trojan.Generic
ZKNiiqoHKV.exe	51%	Virustotal		Browse
ZKNiiqoHKV.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538056
Start date and time:	2024-10-20 07:09:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZKNiiqoHKV.exe renamed because original name is a hash value
Original Sample Name:	6bacbe921c817ef6fc3d2fa1b8cd100452d5f002bd76ce536632abc633f571ae.exe
Detection:	MAL
Classification:	mal60.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ZKNiiqoHKV.exe, PID 6932 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.838331867842023
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZKNiiqoHKV.exe
File size:	6'152'208 bytes
MD5:	1169e07116b990459d7c3d52bc4f58fe
SHA1:	f4d6680399237143f914902bf7c8be0475589625
SHA256:	6bacbe921c817ef6fc3d2fa1b8cd100452d5f002bd76ce536632abc633f571ae
SHA512:	e0d01375f1406f000984310da01c4a47392bfe047e1765c884539a6de5cecac57e2dc4689a543640351b3c87d7b5b1f66814601e734bc391566b38521690c2dd
SSDEEP:	98304:PFfja85LghXwp+TXGRgUjK7WzvqutBUwSoKVFuYgNXrxJmEYM7WFW4i6iQ3h4zWF:wi8XHXYgUjiWzvqkxSoWBwiU4LiI4aF
TLSH:	C2561227F684ADD6D1E336B6CF0524414713BF221A861659A03F36C9FA3558F87A23CB
File Content Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......O.J...$Y..$Y..$Y@.'X..$Y.._Y..$Y...Y..$Y@. X:.$Y@.!X..$Y@."X..$Y.. X..$Y..'X..$Y..!X..$Y1g X..$Y1g'X..$Y]._Y..$Y...Y..$Y,!_Y..$

File Icon


Icon Hash:	e7633d1e4b6d3015

Static PE Info

General

Entrypoint:	0x14231b058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x662FBE31 [Mon Apr 29 15:35:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7e6f624a623fc1ceed378db513c1db46

Entrypoint Preview

Instruction
call 00007F71591D1FB7h
inc ecx
push edx
dec ecx
mov edx, esp
inc ecx
push edx
dec ecx
mov esi, dword ptr [edx+10h]
dec ecx
mov edi, dword ptr [edx+20h]
cld
mov dl, 80h
mov al, byte ptr [esi]
dec eax
inc esi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F71591D1E16h
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F71591D1E90h
xor eax, eax
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F71591D1F38h
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
je 00007F71591D1E3Bh
push edi
mov eax, eax
dec eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
jmp 00007F71591D1DBAh
mov eax, 00000001h
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F71591D1E39h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jc 00007F71591D1E18h
sub eax, ebx
mov ebx, 00000001h
jne 00007F71591D1E60h
mov ecx, 00000001h

Rich Headers

Programming Language:

[IMP] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1da9251	0x310	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1dab000	0x5b688	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22b688c	0x2d36c	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x261b000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1daa018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x43a5fc	0x1fe000	c79b1956b7e29e74321fb8164b9d2715	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x43c000	0xfc018	0x53800	049e5b46815e952035e4cc1d04523ad8	False	0.993994433008982	data	7.948410341761069	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x539000	0x17d1424	0x6e00	4e860e0acb7264a2a0ff64a0665249fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x1d0b000	0x2d300	0x1a800	b33213f26ade5c573e083f069efca599	False	0.9510889593160378	data	7.6973046929840505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1d39000	0x15c	0x200	f62c839df22bae3afd8e8f3051131e38	False	0.421875	data	3.4689129896223285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1d3a000	0x5b688	0x9600	95881821aabd8cb83a5deacb01fa14c5	False	0.9973697916666666	data	7.949298340088709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1d96000	0x125a4	0x6000	67eea4667fda8fedcb7540a406c81df0	False	0.5920003255208334	data	7.656381181007976	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x1da9000	0x1000	0x600	4a4b786f4168b012ed0d7ccba2cc2258	False	0.3860677083333333	data	3.738362225674898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1daa000	0x1000	0x200	46a3fa9b9c474bebe443ead3ca8d98ab	False	0.0625	data	0.28456851570206254	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1dab000	0x5b800	0x5b800	2a0888d24145ea2eabeab39a5e2b301b	False	0.10006030140027322	data	2.079425753252139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x1e07000	0x514000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x231b000	0x2ff400	0x2ff400	f7cc1add78644617f396f9aa8a131806	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x261b000	0x1000	0x10	a51e02a72ae53a9f5a7067a2fe4ecbe8	False	1.5	GLS_BINARY_LSB_FIRST	2.5306390622295662	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1dab1c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Korean	North Korea	0.2978723404255319
RT_ICON	0x1dab1c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Korean	South Korea	0.2978723404255319
RT_ICON	0x1dab638	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Korean	North Korea	0.24262295081967214
RT_ICON	0x1dab638	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Korean	South Korea	0.24262295081967214
RT_ICON	0x1dabfd0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Korean	North Korea	0.20919324577861162
RT_ICON	0x1dabfd0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Korean	South Korea	0.20919324577861162
RT_ICON	0x1dad088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Korean	North Korea	0.16224066390041494
RT_ICON	0x1dad088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Korean	South Korea	0.16224066390041494
RT_ICON	0x1daf640	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Korean	North Korea	0.14218233349078885
RT_ICON	0x1daf640	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Korean	South Korea	0.14218233349078885
RT_ICON	0x1db3878	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	Korean	North Korea	0.10500709807169052
RT_ICON	0x1db3878	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	Korean	South Korea	0.10500709807169052
RT_ICON	0x1dc40b0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	Korean	North Korea	0.08794049767730863
RT_ICON	0x1dc40b0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	Korean	South Korea	0.08794049767730863
RT_GROUP_ICON	0x1e060e8	0x68	data	Korean	North Korea	0.7403846153846154
RT_GROUP_ICON	0x1e060e8	0x68	data	Korean	South Korea	0.7403846153846154
RT_VERSION	0x1e06160	0x2ec	data	English	United States	0.4451871657754011
RT_MANIFEST	0x1e0645c	0x227	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (491), with CRLF line terminators	English	United States	0.5353901996370236

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
WININET.dll	HttpQueryInfoA
d3d9.dll	Direct3DCreate9
d3dx9_43.dll	D3DXVec3Normalize
fmod64.dll	FSOUND_Update
USER32.dll	SetWindowPlacement
GDI32.dll	GetPixel
MSIMG32.dll	TransparentBlt
WINSPOOL.DRV	DocumentPropertiesA
ADVAPI32.dll	RegSetValueExW
SHELL32.dll	SHGetSpecialFolderPathA
SHLWAPI.dll	StrStrIA
UxTheme.dll	DrawThemeText
ole32.dll	CoTaskMemAlloc
OLEAUT32.dll	VariantCopy
WS2_32.dll	WSAEventSelect
gdiplus.dll	GdipCreatePen1
OLEACC.dll	LresultFromObject
IMM32.dll	ImmGetContext
WINMM.dll	PlaySoundA
dbghelp.dll	MiniDumpWriteDump

Possible Origin

Language of compilation system	Country where language is spoken	Map
Korean	North Korea
Korean	South Korea
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 07:10:24.414190054 CEST	53	51804	1.1.1.1	192.168.2.4

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: ZKNiiqoHKV.exePID: 6932, Parent PID: 2580

General

Target ID:	0
Start time:	01:09:55
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\ZKNiiqoHKV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ZKNiiqoHKV.exe"
Imagebase:	0x140000000
File size:	6'152'208 bytes
MD5 hash:	1169E07116B990459D7C3D52BC4F58FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZKNiiqoHKV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: ZKNiiqoHKV.exePID: 6932, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
ZKNiiqoHKV.exe