^�����^h�ծR�<����!�I�pI�3��/\�-z{G�)~Gީ�Y_d JZb<� �����W���re�"����}*xٴ�Rn`���@u]�yX։#�h/��ʲM��:�ȞR*O���6[^�c��D�x�t�T��S�b ����s��gG}����S=-Bn���?� ���P(��{��&ҡM�1��=��0��2��*M��/f��5�N��m����X3|$1� gm���)@_k�˺�8�\�X�V��Y&��*�t����A��#(}4(�R�((V��^>��K�����<2�}#�%Ls�;�{nT�P.�QG�YY��W��<�{�SP_X)��M$۫ �E�퓬 �HI�����Ð���q����.�Mc�oQQ��qz��m��4"N�Q���>c��X��DR�:�]�?+V�m�: ��Qqz}1�/��Vq��7�M��I(vA"n\ob��� �����ckB�h�t�Ϡ[s��� �p\�o�+o x&mmІok�xN�J`7q#f���X om>�}�g��M�3a����Aw�1�y]����`rJ���`8]�E4��~Oe貿jxX<����{�ԑڙ�܋��Gu�rFW���n�_*��C�����Tb����ӿÔ�g<Ӣ��8��[Z���!�m8���a�A�����Hle�U��G h=��r���qB�u��P�ͳ���SS��ڜ�i��$1��f�{s�,����0H}�e�����6^�,�FUX ���5 W?��1!�v���'������^��D �n3f�e p&/�<|�|���g����r��.3����hk�S�P8�Q%Jm����/�m�k�J���ί_G��m��Xt2hR>��FC�`\;�}r��ܝ�Tr�7tʲD�_�l&� �Ȋ����������ZIG����xA�H>�����F���i�����]���g�CQ�a�8�v�eTέ.����� ���4�A�Z��4:�w��=m3 �ٟ�J�u%4`��a�×�U�zV�w���M������%Oă"��pY���b�ڑ�m��¥^�%��H�_T�+�O�.j��������C �c;d�v^|���Ej��g5X%{�J'�;�/}��j��O�eE�>�!Z���,�ڶfR�~`1�#��Z��s���,[�BlR� ���S�tj�:�����D>2?��c�2�w8k��;��w�@R�@?��k�v>NB�?���,�}%�#�m���@R@�i��u��������|�~W��6����0 �R�����MX3X̘��+��Z�P��6"%��%�$�۵�LL0}�J���zA]q��H��L��9�`���g`q<5�jl�X��Co�R6� ��wnDH�sC�2����k]dt�h=Y0�� +j��6g:1�Iy'д��%��ɝp��\3|u���}e�V֦�H �� ����炝r @���X!n^D,E� �op���P�0A[�D�cb�>.��@3�;!��d(,��F���N��`�3(�{d/;Q�{JO�8T?s!w�O��� Xo�k �|���� 6�*�}Ntu��\�R�m .xM�5}�0$l��J7O��S�O�P1d�!֓���)Ϣ�gV��j���Q� h�f�!�jk��Oҿ[̦a&[���*�g2Z4�f��o*x-�F�=�'yI��gG:Y�dC;�c�y/�#O�!��-���>�_L:��D�z� )H�N+k��Ҽ���9i/t\�\P�N����%�0S�a�(�]����E�9�k���_�-`��"�b�S����[s������qM��£ѷҖ����Xl,�I�cX:�p9�7�f�}��~��bٙ�`��f�K����d杸���ةZ����'�s��� %o'��GӖX���9�����LŌ|}j�ŷ����<�w�R>����.�^ �� 9iH7s�Ð:h���ആ����h �Aw�+B���Z@`�&Z��G ��G�MR���Z'���X��̥�-�g�Lt%�4N����X�5b� s�$��n��ݫ��j�"�{]%�[䈨� M@��^�]s�*�F�k�E��Sr0_4^G���%��0>��4�α���n��*M��`�>���,��v��EX�#K5��_]�����q�4�IY;�<�>��Eg�+]6� ��,E~b�����)W~�r�l���"��� L�V�o�����a��ľ�-��4�%vh���y����W�J���<!���|���O�$ �0��@�3����0�|�>_z䷌�\O$���6BXGʓ8���)K���Y��&|�� �d��Z��ޱ-D��� ��p�p��pcUHv�ň��w1������ť���9,�P�����)�|֣���|<��G� �����!tMKo�[W\�J�}^�m=#A=~DŽn��/����h��2��G��pn�҃��5 yҳ�4�L�I���Wt�R�.�� ��`&��Q�8��벫���x99���L���<�����j@�{v�b����� �l��ms�-0ĻQ��4���Գ1& ת����2Q�g߄��T��:jP�&�ys���Juq��/��vo�ˋފ��$��{��>s�9ٞ����1��-���ن���SCL0, d������\��v�K���*$7��[,��t[-���^��`"�=�C��2�%���?�ږ��#�X;���)�TSO�s<+Ƭ��r�t�YGGI�i��=�FPK�3��9�v�o7���U]��dN�w�?������#���1YW������Z���ٸI~.p/��y���|��v��.�;b�ït��s�ou�J ������ѷ؝��G��ljKURj#���%�3�[�j���N���Uc�gȯ|h���{4�1A2�%`߅J�d����ӑ�ͯ�6��m�Y�J|�*,|R�N�b˵�2K��w�8w�%H{�#��������nYT���?c�Uođ�1��t摗PN6���y���/y��Rp� k�k��6mh���s��ǣҍ�ȸ"걩���� � ��2B.nI*7��p9
Behavioral task
behavioral1
Sample
KAKEInjector.exe
Resource
win10-20240404-en
General
-
Target
KAKEInjector.exe
-
Size
13.3MB
-
MD5
d3e95be2649c118c1a29845bb01d276d
-
SHA1
95c60314bddcead34a0debd5dd88a27ee5b2043a
-
SHA256
e99851d913f6351aac755889657d9264c68ab8a514111340b34aa1288f33f557
-
SHA512
3f171395b24c49adb5c1dadc140be26df7cf853c3cd6cc1029ebbfdd24d5dd5fb68db9e0a2903d301e4c433e76e31c9ff4963781fc92d7a4b3d8b21ecc572f8f
-
SSDEEP
196608:WsNTktYiCgG0NHlgd8rZs2ZfM7l2vNcRWDXotySxQXixPjTFmtxGov:dTGTVGwlgd/2FMZeNyv6SxjhmR
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource KAKEInjector.exe
Files
-
KAKEInjector.exe.exe windows:6 windows x64 arch:x64
d67fd4ef817512cde0c12b40172cce97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
shell32
ShellExecuteW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChainEngine
ws2_32
freeaddrinfo
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ