�+��R���1�p ���mf�@��'@.mH9]nW�ҟ�(@@:�R���ڠoo� ��D�sc��_�1�v=#������� z�=��j�1�$�!|_EN��U1�n�n���*U��:��Q��u��*��O�pO��3���Q��H�<EeN��5�Y�T�a?��,�x /��z=���8Ѥ�^P2�#�]�0\\�c�ت+0�;����Pxp�Ta�e�� =H:ͨ�`��`(�W}�Zv���!(� p�@������B%��g�Ek<��Z������$��%��1�����,^ ��d/rN�}���"1ؚ:�>2�M��Z�μcSq�mt�ni�^4/"F�@,0��X��0f��G�C��Lȿ�gQ��c�r��;i��:Z�A?�8��\�p�֓�ޟ�����8��Ӓ_f2��.e�#���t�9���� ����u���y|a� t���Ō��ˎ>���M���ܸ*5{!�x �M�s��l�KJ�ZZ!L��,��}_��e4���:D��~,���>�mޮ�t�_�G?����N���"q5HB{Ѡ��"Y4����l�Me�,<͙���z"��Rdx�6ܬ��'\K�lՠ.�����L�Dsp�҉�t=$GC����R�����8X��y��I �����~�e�ʗ��A�(78��y ��TN� �J�b�<j�b������]��Λ>.H�;�Ǥ@�:4��s7�v� @����4wؓ�θt����� 0'���JmɅ�ΰ�G� ����e!����A����4X����F���-��X �V>4KX=��E=�.�l'5ڪ"��tQ��'�G�����[��[^�B�F´�n�?��dB��ji�:H!D��f�`<^t+ ��D틠�Њ<1� �����t}��[�'�C����N�^-J�\���h�y㝟 ���b̉uA���з{DsB�Y9����pV�-a�a���(�Ҕy_|��ue؝-ڞ����Vb�Lm�{Fd������#��5�2��� ���/�䣉R��k/�u[�+HL��g"7<Y���פ}5���UYN���%��aX������[1�h\Bv�o֯H��xU�S�|�D�X ��K�%�V�h=�`պ��j@�2�K8n������>f��� ��l�ˀYUQOm��=�y~���Y@}�"�c���p���ʅ(Q��p�Ķ�k��P�O���V��@����n���q�}BR.I��b>��c���Z���x�������9h9�3Ɓm��&7U�N�u�n��L`���ڣ��e���]|� ��%<��V6 �c�"-wnp:)��~������8M=B���X�0_!��� u.Y�l�r�DZ`yG:'�Vq��A�� %��C�a �E�S�� ��`�7���q9|$�q FF3#�+�O��>4�t��L�р�[�U{������4y� /��:�G������%���ذ��8&������W�5T��;� 6�tHr�T}|sƴ��toU��qgR�-f��i��6,�$���ul鄁@�d��+;��x'+j!SZ=��T��B�=z���wzm����Ҷ�=��mx�G�#,��y��OrCI �X$�����>����kfm�0\�G��a9-��'E����X`�F��LD[3�1#����JA:�^���&����z]�&ڎ����3���_�U%_y��y���4�0�v�ҵ��9K��^����mm$w>ʤ��I�-�me&��#.2���ћ��� ����� ���6�C��!�&�h�5F��>XY�_wE��e�[��Qdž"��!�R;��,@/2�cP���A��@7v�Jo�.2�G�ƈ|Oo�mY��~���W���6D#�:�{6�+����o��CB���(3��W@�;�kP��AA�c���:�}�@ca� �r��t��܋1{E��Y������ ٚȃ���띘,�:�z𘊘��0V��"���YB eYi���q �;Se�9��{��_��h�}HR�3�q,���gOi�#�W �Ǭ1��3v�B���ٞ��U\���χ�*l�8_1G���W��#-v#�q�4��V�9�B]�(e�UF4ty�M��(�M��J� k��4��T)2�w�� 1x�`�O<p��S�BD'��l#��rF��v||��1��q ���f�c��t�\�{�/�h1Skk�q��ŀ����Bn�y��-� ,v]�!�V+X�U��|$Hy� ;��8��i��:�C�͊�9^j�i���U�����w�5�q����7��CA+������ P/W�OT*�����|�Y�x�㪏,�H��ڐ.ʩ����Uw����P�gouE���4�W���Ƌ}>i�F-M�, ɔ��V!�D�o�$�����C��Í� ��AV8�Ǒ��$D�<7��ș�]���I�g�p3�;l����z��o`�t�,�Q����a���[q�8-߫�rD��#�)%��H4���*=��c��;����'���t�5�Lcت���6��2��`����#������U3�6����a�@%��[��b���cG�y��F�;ӷ�$t��nEyF�<&9S�nQ4������6E� �c�*Og��A���]���E~��|�^TH�)�b��zo�v-�/��YcT��=���%������E�y�,S����5 ��1_��G�\K��8&���t����ʸֆ���$��4CP�e����s���T�wr�?[��]���6Xk�0��>�E �W�J��ޤN#�jb���5F�Hm8g�|�oօܲA�q�����9��-c�'��9,��*�`�$�և@ɂRL��U���g�h�(�"*��9(�֞i���7#wEUH���%��I3D� �w�?���#����$d��w`t�}�2���sL��R� N3���'��)�}��.�����]b�!H�{m��'��aD+�ݺ�0�u��E�Ψ� �T��L9%+�7M�ޫfa{��]�ն�~�{\�BU���N^�<�|6�@<���?�L�v��"g�g�K�Q~x�� ܇q�8-T��B��G�a�WމG9�=����`j�=>̙| 4i`/�"�-��z
Behavioral task
behavioral1
Sample
KAKEInjector.exe
Resource
win10v2004-20240508-en
General
-
Target
KAKEInjector.exe
-
Size
13.5MB
-
MD5
f1053bd6f2f6b5dd74d81af9db452f1f
-
SHA1
aa5f30c818dd8196e569c39126e73fb277fdc787
-
SHA256
cfc350c17f9f21c3cee709494d8945190be0d4838698e9161094f53f52c1bd02
-
SHA512
fc7455866addddda8850994b7b14f3dc3ad565f0dc5b6005699ea2a85b849cc3c331039905b19705e42d5194d65cbb9a1d3040be84636db14ff79eea963c204c
-
SSDEEP
393216:LD1rmILrAI3XmgJyL/s2jeUaUXtnseecncyeaGNjRtP7J/2g:n1rTvBXmUwljCebcyfGzl9
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource KAKEInjector.exe
Files
-
KAKEInjector.exe.exe windows:6 windows x64 arch:x64
34277887727d4d5311d6125469177939
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExW
shell32
ShellExecuteA
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChainEngine
ws2_32
freeaddrinfo
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 13.3MB - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ