File name: | KOS_Setup.exe |
Full analysis: | https://app.any.run/tasks/af6bddd0-fc1c-4a54-8e69-94612089898a |
Verdict: | Malicious activity |
Analysis date: | July 13, 2020, 06:49:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1DB7596A7E5DF1521C4490E25488AEE5 |
SHA1: | 29342E4AF1427D26054B96D5D8730DECDD32C51F |
SHA256: | 01800A52019B944CCE61DF057E403FCE4541524FA7A4D1FCA636E976FF86D2AD |
SSDEEP: | 196608:isMhC6GNrTOlVpfyOGWF8LwdqEGegUidL6k1+n3G/VQPuLys:3IC6krYp6OVKM8reMd3dQGLys |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
ProductVersion: | 1.1.1.4 |
---|---|
ProductName: | Kings Online Security_20200408 |
LegalCopyright: | Copyright(c) 2017 Kings Information & Network Co., Ltd. |
FileVersion: | 1.1.1.4 |
FileDescription: | Kings Online Security_20200408 1.1.1.4 Setup 1.0.2.5, Built on 2020-04-08 |
CompanyName: | Kings Information & Network Co., Ltd. |
Comments: | Kings Online Security_20200408 Setup |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 1.1.1.4 |
FileVersionNumber: | 1.1.1.4 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | 6 |
OSVersion: | 5 |
EntryPoint: | 0x39e3 |
UninitializedDataSize: | 16896 |
InitializedDataSize: | 445952 |
CodeSize: | 28672 |
LinkerVersion: | 10 |
PEType: | PE32 |
TimeStamp: | 2012:02:24 20:19:59+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 24-Feb-2012 19:19:59 |
Detected languages: |
|
Comments: | Kings Online Security_20200408 Setup |
CompanyName: | Kings Information & Network Co., Ltd. |
FileDescription: | Kings Online Security_20200408 1.1.1.4 Setup 1.0.2.5, Built on 2020-04-08 |
FileVersion: | 1.1.1.4 |
LegalCopyright: | Copyright(c) 2017 Kings Information & Network Co., Ltd. |
ProductName: | Kings Online Security_20200408 |
ProductVersion: | 1.1.1.4 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000D0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 24-Feb-2012 19:19:59 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00006F10 | 0x00007000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.49788 |
.rdata | 0x00008000 | 0x00002A92 | 0x00002C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.39389 |
.data | 0x0000B000 | 0x00067EBC | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.47278 |
.ndata | 0x00073000 | 0x00109000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0017C000 | 0x00008F48 | 0x00009000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.44437 |
.reloc | 0x00185000 | 0x00000F8A | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 2.07077 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.21712 | 968 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.25211 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 4.51884 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 4.16479 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.62308 | 62 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.73893 | 514 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.91148 | 248 | UNKNOWN | English - United States | RT_DIALOG |
111 | 2.92787 | 238 | UNKNOWN | English - United States | RT_DIALOG |
205 | 2.68176 | 494 | UNKNOWN | English - United States | RT_DIALOG |
206 | 2.86295 | 228 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1844 | "C:\Users\admin\AppData\Local\Temp\KOS_Setup.exe" | C:\Users\admin\AppData\Local\Temp\KOS_Setup.exe | — | explorer.exe |
User: admin Company: Kings Information & Network Co., Ltd. Integrity Level: MEDIUM Description: Kings Online Security_20200408 1.1.1.4 Setup 1.0.2.5, Built on 2020-04-08 Exit code: 3221226540 Version: 1.1.1.4 | ||||
3508 | "C:\Users\admin\AppData\Local\Temp\KOS_Setup.exe" | C:\Users\admin\AppData\Local\Temp\KOS_Setup.exe | explorer.exe | |
User: admin Company: Kings Information & Network Co., Ltd. Integrity Level: HIGH Description: Kings Online Security_20200408 1.1.1.4 Setup 1.0.2.5, Built on 2020-04-08 Exit code: 0 Version: 1.1.1.4 | ||||
1744 | "C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBA20.tmp" "C:\Kings\KOS\KOS_Update.exe" | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBA20.tmp | — | KOS_Setup.exe |
User: admin Integrity Level: HIGH Exit code: 1 | ||||
312 | "C:\Kings\KOS\KOS_Update.exe" | C:\Kings\KOS\KOS_Update.exe | nsBA20.tmp | |
User: admin Company: Kings Information & Network Co., Ltd Integrity Level: HIGH Description: KOS Updater Exit code: 1 Version: 1.0.1.0 | ||||
1440 | "C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBBE6.tmp" "C:\Windows\system32\regsvr32.exe" /u /s "C:\Kings\KOS\kosldr.dll" | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBBE6.tmp | — | KOS_Setup.exe |
User: admin Integrity Level: HIGH Exit code: 5 | ||||
2352 | "C:\Windows\system32\regsvr32.exe" /u /s "C:\Kings\KOS\kosldr.dll" | C:\Windows\system32\regsvr32.exe | — | nsBBE6.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 5 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2688 | "C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBD2F.tmp" "C:\Windows\system32\regsvr32.exe" /s "C:\Kings\KOS\kosldr.dll" | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsBD2F.tmp | — | KOS_Setup.exe |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
3412 | "C:\Windows\system32\regsvr32.exe" /s "C:\Kings\KOS\kosldr.dll" | C:\Windows\system32\regsvr32.exe | — | nsBD2F.tmp |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3924 | "C:\Kings\KOS\KOSSvc.exe" | C:\Kings\KOS\KOSSvc.exe | services.exe | |
User: SYSTEM Company: Kings Information & Network Co., Ltd Integrity Level: SYSTEM Description: KOSSvc.exe Version: 1.0.1.7 | ||||
1200 | "C:\Kings\KOS\KOS_Update.exe" | C:\Kings\KOS\KOS_Update.exe | KOSSvc.exe | |
User: SYSTEM Company: Kings Information & Network Co., Ltd Integrity Level: SYSTEM Description: KOS Updater Exit code: 1 Version: 1.0.1.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3508 | KOS_Setup.exe | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\AccessControl.dll | executable | |
MD5:3BE1899233609DCC3A2286BB41E6717C | SHA256:47F5E3A32657721FB03B3D1A231F96339D9CE12F6972023D87F055F15AE53B04 | |||
3508 | KOS_Setup.exe | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\modern-wizard.bmp | image | |
MD5:1789FDCE38DBC39E054BA2513FCE0ACB | SHA256:7D5D2F09CD511E7C4689619EF38818DABBBD3130BEDC9573534A0D0CD764AC21 | |||
3508 | KOS_Setup.exe | C:\Kings\KOS\KOSSvc.exe | executable | |
MD5:335581F7886C6DF8036DAA0EA1116046 | SHA256:4074B7DAF323EF44D1A24D4584A7431890802F7790E8B9683B042215307C42D5 | |||
3508 | KOS_Setup.exe | C:\Kings\KOS\KOSinj.exe | executable | |
MD5:F8EC7D2D2A4A4C4BE79665F344BC93E6 | SHA256:D17DCE5A0A3DE2E081CD9D4183F409F5EAE199E773425E4F07A4872A80EB900E | |||
3508 | KOS_Setup.exe | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\nsDialogs.dll | executable | |
MD5:4CCC4A742D4423F2F0ED744FD9C81F63 | SHA256:416133DD86C0DFF6B0FCAF1F46DFE97FDC85B37F90EFFB2D369164A8F7E13AE6 | |||
3508 | KOS_Setup.exe | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\System.dll | executable | |
MD5:BF712F32249029466FA86756F5546950 | SHA256:7851CB12FA4131F1FEE5DE390D650EF65CAC561279F1CFE70AD16CC9780210AF | |||
3508 | KOS_Setup.exe | C:\Kings\KOS\ProMDefense.dll | executable | |
MD5:FCD0FB3DE52F0C24E98DDF8C573FBEE2 | SHA256:647119F0630F495B6F36ED2793D82DB334D50FBDC03FFBDDACB0A9B88FEEAAD6 | |||
3508 | KOS_Setup.exe | C:\Kings\KOS\nssdbm3.dll | executable | |
MD5:40CAADE4B80589EFE25801CE814CE04E | SHA256:2559FF13F8CE8319BE78CA63CFB0D1E551E46E49786811889AFEEFB5ABFAE35F | |||
3508 | KOS_Setup.exe | C:\Kings\KOS\softokn3.dll | executable | |
MD5:FD54A0592BDBDC5A20304DDDCF6E9AED | SHA256:ED7DEC8E5C9D9D767039F51050A83441B85CA810CA23CE42FE31AAAC263BDAB7 | |||
3508 | KOS_Setup.exe | C:\Users\admin\AppData\Local\Temp\nsjDD5B.tmp\KNSISPlugin.dll | executable | |
MD5:E36672A2C765D89C6002E86076FC985C | SHA256:91DEBD9C11583282E1A89ED8E72E74BFD30ECBDA55150F2EBB9BE933C38C7B8A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1200 | KOS_Update.exe | GET | — | 14.0.113.209:80 | http://kings.nefficient.co.kr/kings/KOSNax/ | KR | — | — | malicious |
312 | KOS_Update.exe | GET | — | 14.0.113.209:80 | http://kings.nefficient.co.kr/kings/KOSNax/ | KR | — | — | malicious |
3924 | KOSSvc.exe | GET | 404 | 14.0.113.209:80 | http://kings.nefficient.co.kr/kings/KOSNax/x86_KOS_Update/KOS_Update.ini | KR | xml | 345 b | malicious |
312 | KOS_Update.exe | GET | 404 | 14.0.113.209:80 | http://kings.nefficient.co.kr/kings/KOSNax/KOSUpdaterV1.xml | KR | xml | 345 b | malicious |
1200 | KOS_Update.exe | GET | 404 | 14.0.113.209:80 | http://kings.nefficient.co.kr/kings/KOSNax/KOSUpdaterV1.xml | KR | xml | 345 b | malicious |
3460 | KOSinj.exe | GET | 404 | 14.0.113.209:80 | http://kings.nefficient.co.kr/ | KR | xml | 345 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
312 | KOS_Update.exe | 14.0.113.209:80 | kings.nefficient.co.kr | — | KR | malicious |
1200 | KOS_Update.exe | 14.0.113.209:80 | kings.nefficient.co.kr | — | KR | malicious |
3460 | KOSinj.exe | 14.0.113.209:80 | kings.nefficient.co.kr | — | KR | malicious |
3924 | KOSSvc.exe | 14.0.113.209:80 | kings.nefficient.co.kr | — | KR | malicious |
Domain | IP | Reputation |
---|---|---|
kings.nefficient.co.kr |
| malicious |
Process | Message |
---|---|
KOS_Setup.exe | [KNSISPlugin] CVersionUtils::GetModuleVersion Enter |
KOS_Setup.exe | [KNSISPlugin] CVersionUtils::GetModuleVersion Enter |
KOS_Setup.exe | [KNSISPlugin] CVersionUtils::GetModuleVersion Leave |
KOS_Setup.exe | [KNSISPlugin] CVersionUtils::GetModuleVersion Leave |
KOS_Setup.exe | [KNSISPlugin] CheckUserPermission IsAdmin [1] |
KOS_Setup.exe | [KNSISPlugin] CheckUserPermission IsAdmin [1] |
KOS_Setup.exe | [KNSISPlugin] CheckUserPermission Leave |
KOS_Setup.exe | [KNSISPlugin] CheckUserPermission Leave |
KOS_Setup.exe | [KNSISPlugin] Initialize Enter |
KOS_Setup.exe | [KNSISPlugin] Initialize InstallDirectory [C:\Kings\KOS] |