Static task
static1
Behavioral task
behavioral1
Sample
ikernel.exe
Resource
win11-20231215-en
General
-
Target
ikernel.exe
-
Size
596KB
-
MD5
bf25eb6a1e0aa2fff0cb190270b95418
-
SHA1
79cad1291ac8b042af8454328ef7c71ce04a7c9d
-
SHA256
4535320c5b9596a6210109f68c647dbdbd0289ba63286fd389dea910855491f1
-
SHA512
66a4ee419548e63c0a007be91ad58d5e1a6cf37e5df70a5da7ddcc0a1f4831bb42ba67c6cc8ce3d54b99fa77a9249ace9b5cc4836e957103b9901484bb04337b
-
SSDEEP
6144:3EGivITS4+L9J3eu4rqfTN9+w7RSmMaf2uEzSa5XnojeDpKpJK2ajVNR6lcBbYMt:1/8+sVf2ppmKLRsdMziCPpF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ikernel.exe
Files
-
ikernel.exe.exe windows:4 windows x86 arch:x86
e45678bfef61a6e64548acd737aca950
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
lstrcmpA
FindFirstFileA
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
FindNextFileA
FileTimeToLocalFileTime
GetFileSize
GetFileTime
WriteFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetDiskFreeSpaceA
GetTempPathA
GetWindowsDirectoryA
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryExA
WaitForSingleObject
CreateProcessA
LoadLibraryA
lstrcmpiA
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileSectionA
GetPrivateProfileStringA
SetEvent
CreateThread
Sleep
GetCurrentThreadId
CreateEventA
CreateDirectoryA
GetShortPathNameA
GetModuleHandleA
FindClose
HeapDestroy
DeleteCriticalSection
lstrcatA
OpenEventA
SetFilePointer
ReadFile
LockResource
LoadResource
SizeofResource
FindResourceA
SetFileAttributesA
GetCurrentProcess
GetVersionExA
WritePrivateProfileStringA
GetSystemDirectoryA
WinExec
SetFileTime
MoveFileExA
IsBadWritePtr
IsBadReadPtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
RemoveDirectoryA
InitializeCriticalSection
QueryPerformanceFrequency
CreateFileA
CloseHandle
GetFileAttributesA
MoveFileA
DeleteFileA
CopyFileA
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
InterlockedDecrement
LocalFree
InterlockedIncrement
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
WideCharToMultiByte
lstrcpyA
MultiByteToWideChar
lstrlenA
GetLastError
SetLastError
SetErrorMode
GetCommandLineA
GetACP
HeapSize
GetCPInfo
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
UnhandledExceptionFilter
TerminateProcess
TlsGetValue
TlsAlloc
ExitProcess
GetVersion
GetStartupInfoA
HeapAlloc
HeapFree
ExitThread
TlsSetValue
RaiseException
RtlUnwind
HeapReAlloc
LCMapStringA
QueryPerformanceCounter
ResetEvent
GetCurrentThread
CreateFileMappingA
MapViewOfFile
lstrcpynA
VirtualQuery
GetOEMCP
InterlockedExchange
SearchPathA
UnmapViewOfFile
VirtualProtect
user32
GetDesktopWindow
PostThreadMessageA
wsprintfA
CharLowerBuffA
CharNextA
DispatchMessageA
GetMessageA
LoadStringA
TranslateMessage
ExitWindowsEx
CharUpperA
advapi32
RegCloseKey
GetFileSecurityA
IsValidSecurityDescriptor
SetFileSecurityA
RegEnumValueA
RegConnectRegistryA
RegDeleteValueA
RegQueryInfoKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA
RegSetValueA
RegOpenKeyA
RegQueryValueExA
RegQueryValueA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegOpenKeyExA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ole32
StringFromCLSID
CoUninitialize
CoGetClassObject
ProgIDFromCLSID
OleSaveToStream
WriteClassStm
CLSIDFromString
CoTaskMemFree
CoTreatAsClass
CoInitialize
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
StgOpenStorage
StgCreateDocfile
CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
OleLoadFromStream
oleaut32
LoadTypeLi
SafeArrayCopy
RegisterTypeLi
SafeArrayGetDim
SysAllocStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
VariantChangeType
LoadRegTypeLi
SysReAllocStringLen
CreateErrorInfo
SetErrorInfo
VariantInit
VariantCopyInd
VariantCopy
SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString
VariantClear
SafeArrayGetElement
SysStringByteLen
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Sections
.text Size: 428KB - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ