KrampUI[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

KrampUI.exe
Size

16.5MB
MD5

898643f9b1ee99a7801f283e2348d84b
SHA1

e8c2cfcd8bc2f1ad498a5f85bca18cb835e3996c
SHA256

122748cd4c77c507bd225cebcf47285cd6941ea23c3c1672fc1a9decc1946a64
SHA512

aaf1a129ad426e039bfc572accd8e900a2695e89a91627467075e89d51b0e451b1cc4de49a96089ee2dd92acf02221b09630d731e87c7013f668be8e9c12b4f6
SSDEEP

196608:9kuYd4y7op18GLIM0eldluLefAsllLefAs/xLefAs/WTdIUPksvC:93Yd4yspOGLpFI3sn3sZ3sMdpv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KrampUI.exe

Files

KrampUI.exe
.exe windows:6 windows x64 arch:x64

05a64234aea6bd9a24955bc3c132284b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Pixeluted\Desktop\KrampUI\src-tauri\target\release\deps\krampui.pdb

Imports

advapi32

SystemFunction036
RegOpenKeyExW
RegQueryValueExW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegCloseKey
RegGetValueW
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation

ws2_32

getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
shutdown
setsockopt
closesocket
WSAGetLastError
WSARecv
WSASend
WSAGetOverlappedResult
WSAIoctl
listen
getsockname
bind
connect
getsockopt
ioctlsocket
send
recv
WSASocketW
getpeername

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleW
CloseHandle
GetCurrentThreadId
GetLastError
ReleaseMutex
CreateMutexW
SleepConditionVariableSRW
SetFileCompletionNotificationModes
CancelIoEx
ReadFile
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetHandleInformation
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetNativeSystemInfo
LoadLibraryExA
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
CreateEventW
WaitForSingleObject
FormatMessageW
lstrlenW
GetUserDefaultLocaleName
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
GetEnvironmentVariableW
Sleep
GetCurrentProcess
DuplicateHandle
CreatePipe
GetFileInformationByHandle
GetConsoleMode
SetConsoleMode
GetCurrentProcessId
CreateFileW
GetProcessTimes
VirtualQueryEx
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetExitCodeProcess
LocalFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetOverlappedResult
GetStdHandle
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
SetFilePointerEx
WriteFileEx
SleepEx
TerminateProcess
GetProcessId
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapReAlloc
FindNextFileW
FindClose
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
GetFileType
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects

ntdll

NtWriteFile
NtCancelIoFileEx
RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess
NtDeviceIoControlFile
RtlGetNtVersionNumbers
RtlNtStatusToDosError
NtReadFile
NtCreateFile

user32

GetSystemMenu
ShowWindow
CloseClipboard
EnableMenuItem
GetClipCursor
ClipCursor
EnumChildWindows
GetDC
SetClipboardData
ShowCursor
GetMenu
DispatchMessageA
EmptyClipboard
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
AttachThreadInput
ToUnicodeEx
GetKeyboardLayout
GetClipboardData
RegisterHotKey
RegisterClipboardFormatW
UnregisterHotKey
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
MonitorFromPoint
IsClipboardFormatAvailable
RegisterWindowMessageA
EnumDisplayMonitors
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
GetKeyboardState
PostQuitMessage
SendInput
CreateAcceleratorTableW
AppendMenuW
RegisterRawInputDevices
MsgWaitForMultipleObjectsEx
CreateMenu
CheckMenuItem
SetMenuItemInfoW
DestroyAcceleratorTable
SetCapture
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageA
GetForegroundWindow
GetRawInputData
TrackPopupMenu
SetForegroundWindow
CreateIcon
RegisterTouchWindow
FlashWindowEx
GetActiveWindow
SetCursorPos
InvalidateRgn
SetWindowPlacement
GetWindowPlacement
ChangeDisplaySettingsExW
ReleaseCapture
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
IsIconic
SetMenu
SendMessageW
FindWindowW
DefWindowProcW
RegisterClassExW
MessageBoxW
SetWindowPos
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
DestroyIcon
SetCursor
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
DestroyWindow
TrackMouseEvent
PostMessageW
MonitorFromRect
LoadCursorW
ClientToScreen
GetClientRect
GetWindowLongW
CreatePopupMenu
GetUpdateRect
PeekMessageW
PostThreadMessageW
ValidateRect
OpenClipboard
RedrawWindow
SetWindowLongW
IsWindow
CreateWindowExW
RegisterClassW
IsProcessDPIAware
SystemParametersInfoA
IsWindowVisible
AdjustWindowRectEx
GetWindowRect
SetWindowDisplayAffinity
GetSystemMetrics

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass
TaskDialogIndirect

ole32

CoCreateInstance
RevokeDragDrop
CoTaskMemAlloc
CreateStreamOnHGlobal
CoUninitialize
OleInitialize
RegisterDragDrop
CoInitializeEx
CoTaskMemFree

shell32

Shell_NotifyIconGetRect
ShellExecuteW
Shell_NotifyIconW
SHGetKnownFolderPath
SHAppBarMessage
SHCreateItemFromParsingName
CommandLineToArgvW
DragFinish
DragQueryFileW

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo
SysStringLen
GetErrorInfo
SysFreeString

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

secur32

QueryContextAttributesW
AcceptSecurityContext
ApplyControlToken
EncryptMessage
FreeContextBuffer
InitializeSecurityContextW
DeleteSecurityContext
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain

pdh

PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

api-ms-win-crt-math-l1-1-0

pow
trunc
__setusermatherr
round
floor

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncmp
wcslen
strcpy_s
strlen

api-ms-win-crt-runtime-l1-1-0

strerror
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_onexit_table
__p___argc
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_crt_atexit
_seh_filter_exe
terminate
abort
__p___argv

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free
calloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

05a64234aea6bd9a24955bc3c132284b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

kernel32

ntdll

user32

comctl32

ole32

shell32

gdi32

dwmapi

oleaut32

uxtheme

bcrypt

secur32

crypt32

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8.6MB - Virtual size: 8.6MB

.rdata Size: 7.4MB - Virtual size: 7.4MB

.data Size: 21KB - Virtual size: 33KB

.pdata Size: 439KB - Virtual size: 439KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 8.6MB - Virtual size: 8.6MB

.rdata
Size: 7.4MB - Virtual size: 7.4MB

.data
Size: 21KB - Virtual size: 33KB

.pdata
Size: 439KB - Virtual size: 439KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 71KB - Virtual size: 71KB