KrampUI[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

KrampUI.exe
Size

17.3MB
MD5

837122705edd80925d0b175d14100e6f
SHA1

1d4deb47ed8e4a04f0d90e8348eb43c21280fb60
SHA256

58ead4f71b8a1bed5820e82bd8f50e55da924e7ca38c2d2aded24e0c6b91faa2
SHA512

42bdee531d2ac59836fb6162ca83c561e716e2fc6082d6a86e1bae973c452e710b8a56e013ae25c372a828849230f1dc3347c7bb1fe80aa752d9352b28806ade
SSDEEP

98304:cBxRT5JqQA8LOfnmJAiF04Lv23vj7wJsTIHy1E7rDfBw/m931PVTTolT6dUZPfbr:+tnkWHonLefAs1xL11RBbdq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KrampUI.exe

Files

KrampUI.exe
.exe windows:6 windows x64 arch:x64

01a588d3fe64849f6262e5705a20815f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
SystemFunction036
RegCloseKey
OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW

ws2_32

getsockname
send
WSAGetLastError
getaddrinfo
getpeername
getsockopt
connect
shutdown
WSARecv
WSASend
WSAGetOverlappedResult
bind
WSACleanup
WSAStartup
WSAIoctl
freeaddrinfo
recv
ioctlsocket
setsockopt
closesocket
listen
WSASocketW

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
LoadLibraryExW
OutputDebugStringW
OutputDebugStringA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
HeapFree
CloseHandle
SwitchToThread
QueryPerformanceCounter
GetLastError
RemoveDirectoryW
FindClose
MoveFileExW
CopyFileExW
SetFileCompletionNotificationModes
CreateMutexW
GetModuleHandleW
GetStdHandle
GetConsoleMode
SetConsoleMode
GetCurrentThreadId
CreateWaitableTimerExW
Sleep
SetWaitableTimer
WaitForSingleObject
ReleaseMutex
GetModuleHandleA
GetProcAddress
GetUserDefaultLocaleName
GetSystemInfo
GetNativeSystemInfo
GlobalLock
GlobalSize
GlobalUnlock
MultiByteToWideChar
GlobalAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
SetEnvironmentVariableW
FindFirstFileW
CancelIoEx
lstrlenW
CreateIoCompletionPort
SleepConditionVariableSRW
GetQueuedCompletionStatusEx
WakeConditionVariable
HeapReAlloc
GlobalFree
GetFileType
GetFileInformationByHandleEx
TryAcquireSRWLockExclusive
PostQueuedCompletionStatus
SetHandleInformation
WakeAllConditionVariable
QueryPerformanceFrequency
GetProcessId
TerminateProcess
GetCurrentThread
WriteConsoleW
SetLastError
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
ExitProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
VirtualQueryEx
LocalFree
GlobalMemoryStatusEx
K32GetPerformanceInfo
OpenProcess
LoadLibraryW
LoadLibraryExA
FreeLibrary
SetFilePointerEx
CreatePipe
GetUserDefaultUILanguage
LCIDToLocaleName

ntdll

RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlGetNtVersionNumbers

user32

SetMenuItemInfoW
ShowCursor
AppendMenuW
CreateAcceleratorTableW
PostQuitMessage
AdjustWindowRectEx
SystemParametersInfoA
FindWindowW
GetDC
IsProcessDPIAware
VkKeyScanW
MapVirtualKeyExW
CreateMenu
CreatePopupMenu
UnregisterHotKey
RegisterHotKey
ClipCursor
GetAsyncKeyState
DispatchMessageA
GetClipCursor
GetSystemMenu
GetKeyboardState
AttachThreadInput
GetKeyState
EnumChildWindows
RegisterClassExW
CallNextHookEx
ToUnicodeEx
TrackPopupMenu
GetKeyboardLayout
GetWindowThreadProcessId
ShowWindow
OpenClipboard
SetWindowLongW
SetCursorPos
GetWindowTextW
GetWindowTextLengthW
CreateWindowExW
GetForegroundWindow
SetWindowTextW
IsIconic
IsWindowVisible
GetMenu
GetActiveWindow
SetMenu
EnumDisplayMonitors
MonitorFromPoint
CheckMenuItem
EnableMenuItem
RegisterClassW
DestroyIcon
DestroyAcceleratorTable
FlashWindowEx
SetWindowPlacement
ChangeDisplaySettingsExW
TranslateAcceleratorW
GetAncestor
GetUpdateRect
ValidateRect
GetRawInputData
CreateIcon
InvalidateRgn
SetWindowDisplayAffinity
SendInput
MapVirtualKeyW
SetForegroundWindow
RegisterTouchWindow
IsWindow
RegisterRawInputDevices
CloseClipboard
SetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetSystemMetrics
DefWindowProcW
GetWindowLongPtrW
RegisterWindowMessageA
SetWindowPos
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
SetCursor
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
ReleaseCapture
DestroyWindow
TrackMouseEvent
SetCapture
MonitorFromRect
LoadCursorW
GetWindowPlacement
GetWindowRect
ClientToScreen
GetWindowLongW
GetMessageA
SetWindowsHookExA
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
PeekMessageW
DispatchMessageW
GetMessageW
PostThreadMessageW
MessageBoxW
GetClientRect
RedrawWindow
SendMessageW
SetWindowLongPtrW
GetClipboardData

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
OleInitialize
RevokeDragDrop
CoInitializeEx
CoUninitialize
RegisterDragDrop
CoTaskMemFree

comctl32

DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect
SetWindowSubclass

shell32

Shell_NotifyIconW
SHAppBarMessage
SHGetKnownFolderPath
SHCreateItemFromParsingName
CommandLineToArgvW
ShellExecuteW
DragFinish
DragQueryFileW
Shell_NotifyIconGetRect

gdi32

GetDeviceCaps
CreateRectRgn
DeleteObject

dwmapi

DwmEnableBlurBehindWindow

crypt32

CertFreeCertificateChain
CertFreeCertificateContext
CertEnumCertificatesInStore
CertDuplicateStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertCloseStore
CertAddCertificateContextToStore
CertGetCertificateChain
CertOpenStore
CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

secur32

DecryptMessage
EncryptMessage
AcceptSecurityContext
QueryContextAttributesW
AcquireCredentialsHandleA
FreeContextBuffer
ApplyControlToken
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextW

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

pdh

PdhRemoveCounter
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhOpenQueryA

powrprof

CallNtPowerInformation

uxtheme

SetWindowTheme

oleaut32

SysStringLen
SysFreeString
GetErrorInfo
SetErrorInfo

api-ms-win-crt-math-l1-1-0

trunc
round
pow
floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s
wcslen
_wcsicmp
wcsncmp
strlen

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol

api-ms-win-crt-runtime-l1-1-0

_exit
__p___argc
__p___argv
_set_app_type
_cexit
exit
_seh_filter_exe
_register_thread_local_exe_atexit_callback
abort
_initterm_e
_initterm
terminate
_crt_atexit
_configure_narrow_argv
_register_onexit_function
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
calloc
_set_new_mode

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01a588d3fe64849f6262e5705a20815f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

kernel32

ntdll

user32

ole32

comctl32

shell32

gdi32

dwmapi

crypt32

bcrypt

secur32

psapi

pdh

powrprof

uxtheme

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 8.1MB - Virtual size: 8.1MB

.rdata Size: 8.7MB - Virtual size: 8.7MB

.data Size: 2KB - Virtual size: 14KB

.pdata Size: 363KB - Virtual size: 362KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 8.7MB - Virtual size: 8.7MB

.data
Size: 2KB - Virtual size: 14KB

.pdata
Size: 363KB - Virtual size: 362KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 44KB - Virtual size: 43KB