securekernel[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

securekernel.exe
Size

901KB
MD5

4b7dabb51ee63e8502517c6616940ae9
SHA1

0f564e2ed40d874a64cbda63488a622cbe8c6a91
SHA256

40e03060d08602a49266d69cb265896434106c27dab2821a29360a6d94f8df7b
SHA512

79414693375305681b3f15226f7a079c55eef4c51c0f1936936c167de698cef0258cd55c0195bbaeec8459453d2c2002dd098614541320f60956d17fa55d3175
SSDEEP

12288:nZs22IdJbn/osotubg3leyMxVO9K3PDJ+i5M+rPF+isy2mTwCttttKkXCMILirN6:Zxj/os3KQPDwzCkQ2mrtttthI2eo+

Score

1^/10

Malware Config

Signatures

Files

securekernel.exe
.sys windows:10 windows x64 arch:x64

9517f76f2e2d36446c9c6b04272cd2a1

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:4d:dd:a2:cf:80:ab:5f:c4:63:67:03:ec:4b:39:63:d8:f8:81:21:56:b4:df:07:13:10:b6:3e:f1:2e:95:ad
Signer

Actual PE Digest

ad:4d:dd:a2:cf:80:ab:5f:c4:63:67:03:ec:4b:39:63:d8:f8:81:21:56:b4:df:07:13:10:b6:3e:f1:2e:95:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

securekernel.pdb

Imports

skci

SkciQueryImageAuthorID
SkciValidateAmeCertChain
SkciQueryInformation
SkciMatchHotPatch
SkciTransferVersionResource
SkciValidateDynamicCodePages
SkciValidateImageData
SkciQueryImageUniqueID
SkciCreateSecureImage
SkciCompareSigningLevels
SkciInitialize
SkciSetCodeIntegrityPolicy
SkciCreateCodeCatalog
SkciFreeImageContext
SkciFinishImageValidation
SkciFinalizeSecureImageHash

cng.sys

BCryptDestroyHash
EntropyProvideData
BCryptSetProperty
BCryptCloseAlgorithmProvider
CngGetFipsAlgorithmMode
SystemPrng
BCryptDecrypt
BCryptEncrypt
BCryptKeyDerivation
BCryptGenerateSymmetricKey
BCryptImportKeyPair
EntropyRegisterSource
BCryptVerifySignature
BCryptDestroyKey
BCryptSignHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptGetProperty
EntropyPoolTriggerReseedForIum

ext-ms-win-ntos-ksr-l1-1-0

KsrSkInitSystem

ext-ms-win-ntos-vmsvc-l1-1-0

SvcSkInitSystem

Exports

Exports

DbgPrintEx
EtwRegister
EtwSetInformation
EtwUnregister
EtwWrite
EtwWriteTransfer
ExAcquireFastMutex
ExAcquirePushLockExclusiveEx
ExAcquirePushLockSharedEx
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAllocatePoolWithTag
ExAllocateTimer
ExCreateCallback
ExDeletePagedLookasideList
ExDeleteResourceLite
ExEventObjectType
ExFreePoolWithTag
ExInitializePagedLookasideList
ExInitializeResourceLite
ExIsResourceAcquiredSharedLite
ExNotifyCallback
ExQueryDepthSList
ExRegisterExtension
ExReleaseFastMutex
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
ExReleaseResourceLite
ExSetTimer
ExSubscribeWnfStateChange
ExUnsubscribeWnfStateChange
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
IoAllocateIrp
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoCreateDevice
IoDeleteDevice
IoGetDeviceObjectPointer
IoQueueWorkItem
IoQueueWorkItemEx
IoRegisterPlugPlayNotification
IoReuseIrp
IoUnregisterPlugPlayNotificationEx
IoWMIRegistrationControl
IofCallDriver
IofCompleteRequest
IumDebugNumToString
IumDebugPrintNt
KeAcquireSpinLockRaiseToDpc
KeBugCheck
KeBugCheckEx
KeDelayExecutionThread
KeEnterCriticalRegion
KeEnterGuardedRegion
KeGetCurrentIrql
KeGetCurrentProcessorNumberEx
KeGetCurrentThread
KeInitializeEvent
KeInitializeMutex
KeInitializeSpinLock
KeLeaveCriticalRegion
KeLeaveGuardedRegion
KeQueryPerformanceCounter
KeQueryUnbiasedInterruptTime
KeReleaseMutex
KeReleaseSpinLock
KeResetEvent
KeRestoreExtendedProcessorState
KeSaveExtendedProcessorState
KeSetEvent
KeWaitForSingleObject
MmAllocateMappingAddress
MmFreeMappingAddress
MmFreePagesFromMdl
MmGetSystemRoutineAddress
MmMapLockedPagesSpecifyCache
MmMapLockedPagesWithReservedMapping
MmUnmapLockedPages
MmUnmapReservedMapping
NtQuerySystemInformation
ObReferenceObjectByHandle
ObSetSecurityObjectByPointer
ObfDereferenceObject
ObfReferenceObject
PsGetCurrentProcess
PsGetProcessCreateTimeQuadPart
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlAssert
RtlAvlInsertNodeEx
RtlAvlRemoveNode
RtlClearAllBits
RtlClearBit
RtlCompareMemory
RtlCompareUnicodeString
RtlCompareUnicodeStrings
RtlCopyUnicodeString
RtlDuplicateUnicodeString
RtlEqualUnicodeString
RtlFindExportedRoutineByName
RtlFindNextForwardRunClear
RtlFindSetBits
RtlFreeUnicodeString
RtlGetEnabledExtendedFeatures
RtlGetPersistedStateLocation
RtlGetVersion
RtlImageNtHeaderEx
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitializeBitMap
RtlIntegerToUnicodeString
RtlNtStatusToDosError
RtlNtStatusToDosErrorNoTeb
RtlNumberOfSetBits
RtlPrefixUnicodeString
RtlQueryRegistryValuesEx
RtlRbInsertNodeEx
RtlRbRemoveNode
RtlSetBit
RtlSetBits
RtlTimeFieldsToTime
RtlUTF8StringToUnicodeString
RtlUTF8ToUnicodeN
RtlUnicodeStringToInteger
RtlUnicodeStringToUTF8String
RtlUnicodeToUTF8N
RtlUpcaseUnicodeChar
SeAuditFipsCryptoSelftests
SeCaptureSubjectContext
SeLockSubjectContext
SeQueryAuthenticationIdToken
SeQuerySecureBootPlatformManifest
SeQuerySecureBootPolicyValue
SeReleaseSubjectContext
SeReportSecurityEventWithSubCategory
SeSetAuditParameter
SeUnlockSubjectContext
ShvlCompleteIntercept
ShvlEnableVpVtlForPartition
ShvlGetInterceptData
ShvlGetPartitionProperty
ShvlGetVpRegisters
ShvlLockSparseGpaPageMapping
ShvlModifySparseSpaPageHostAccess
ShvlSetPartitionProperty
ShvlSetVpRegisters
ShvlUnlockSparseGpaPageMapping
SkAcquirePushLockExclusive
SkAcquirePushLockShared
SkAllocateNormalModePool
SkAllocatePool
SkFreeNormalModePool
SkFreePool
SkGetIdkSignatureForData
SkInitializePushLock
SkIsSecureKernel
SkQuerySecureKernelInformation
SkQuerySystemTime
SkReleasePushLockExclusive
SkReleasePushLockShared
SkSystemExceptionFilter
SkciCreateSecureImage
SkciFinalizeSecureImageHash
SkciFinishImageValidation
SkciFreeImageContext
SkeCacheInvalidatePage
SkeEnterCriticalRegion
SkeLeaveCriticalRegion
SkeZeroPages
SkmmFreeReservedMapping
SkmmFreeSecureAllocation
SkmmMapMdl
SkmmMapMdlWithReservedMapping
SkmmReleasePageRestriction
SkmmReserveMappingAddress
SkmmRestrictPage
SkmmUnmapMdl
SkobCreateHandle
SkobCreateObject
SkobDereferenceObject
SkobReferenceObject
SkobReferenceObjectByHandle
VslExchangeEntropy
ZwClose
ZwCreateKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwLoadDriver
ZwOpenKey
ZwQueryInformationProcess
ZwQueryKey
ZwQuerySystemInformation
ZwQueryValueKey
ZwSetSystemInformation
ZwSetValueKey
ZwUnloadDriver
__C_specific_handler
__GSHandlerCheck
__GSHandlerCheck_SEH
__chkstk
_invalid_parameter
_local_unwind
_ultow_s
_vsnwprintf
_wcsicmp
_wcsnicmp
atoi
atol
bsearch
bsearch_s
isdigit
memcmp
memcpy
memmove
memset
qsort
strnlen
wcscmp
wcscpy_s
wcsncmp

Sections

.text
Size: 633KB - Virtual size: 633KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

KVASCODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRNS
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ZEROPAGE
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

TABLERO
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALMOSTRO
Size: 512B - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

FUNCTBL
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CFGRO
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nlsdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9517f76f2e2d36446c9c6b04272cd2a1

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ad:4d:dd:a2:cf:80:ab:5f:c4:63:67:03:ec:4b:39:63:d8:f8:81:21:56:b4:df:07:13:10:b6:3e:f1:2e:95:adSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

skci

cng.sys

ext-ms-win-ntos-ksr-l1-1-0

ext-ms-win-ntos-vmsvc-l1-1-0

Exports

Exports

Sections

.text Size: 633KB - Virtual size: 633KB

KVASCODE Size: 5KB - Virtual size: 4KB

TRNS Size: 1024B - Virtual size: 712B

PAGELK Size: 1KB - Virtual size: 1KB

ZEROPAGE Size: - Virtual size: 4KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 56KB - Virtual size: 105KB

.pdata Size: 31KB - Virtual size: 30KB

TABLERO Size: 512B - Virtual size: 12KB

ALMOSTRO Size: 512B - Virtual size: 23KB

FUNCTBL Size: 6KB - Virtual size: 6KB

CFGRO Size: 512B - Virtual size: 8B

nlsdata Size: 74KB - Virtual size: 74KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ad:4d:dd:a2:cf:80:ab:5f:c4:63:67:03:ec:4b:39:63:d8:f8:81:21:56:b4:df:07:13:10:b6:3e:f1:2e:95:ad
Signer

.text
Size: 633KB - Virtual size: 633KB

KVASCODE
Size: 5KB - Virtual size: 4KB

TRNS
Size: 1024B - Virtual size: 712B

PAGELK
Size: 1KB - Virtual size: 1KB

ZEROPAGE
Size: - Virtual size: 4KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 56KB - Virtual size: 105KB

.pdata
Size: 31KB - Virtual size: 30KB

TABLERO
Size: 512B - Virtual size: 12KB

ALMOSTRO
Size: 512B - Virtual size: 23KB

FUNCTBL
Size: 6KB - Virtual size: 6KB

CFGRO
Size: 512B - Virtual size: 8B

nlsdata
Size: 74KB - Virtual size: 74KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB