KLSetup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KLSetup.exe
Size 8.2MB
Sample240612-scshrashrq
SHA256 4f128c759e90606c9c7b5546259a7888b2aaaf5ea59d1aa40d5284056366504c
MD5 65f0ee72fac85b324a0734053d436918
SHA1 796d3ab9803f5e6ec370ff948f654842af62fd25
SHA512 b18d612652d2023b7ca49bf0008d6f6a77bab25c70fb9d67bd29c4a917344275c2fbe14058e8121e0ec3e2278ae100b66e49494aa63a2d2570d7d95b6c64ed52
SSDEEP 98304:bEo5z/yF0ULxVuZ6xfTGeUVSO6HVyW2iI30Ge2JW9GU5M0xZh:bt5zqF0KTlXV/luWUU66D
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

KLSetup.exe

.exe 8.2MB

KLSetup.exe

IMPHASH 90c21f135449bd1cda688e778dfc3272
SHA256 4f128c759e90606c9c7b5546259a7888b2aaaf5ea59d1aa40d5284056366504c
MD5 65f0ee72fac85b324a0734053d436918
SHA1 796d3ab9803f5e6ec370ff948f654842af62fd25
SHA512 b18d612652d2023b7ca49bf0008d6f6a77bab25c70fb9d67bd29c4a917344275c2fbe14058e8121e0ec3e2278ae100b66e49494aa63a2d2570d7d95b6c64ed52
SSDEEP 98304:bEo5z/yF0ULxVuZ6xfTGeUVSO6HVyW2iI30Ge2JW9GU5M0xZh:bt5zqF0KTlXV/luWUU66D
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

111112

PE Signature issue

Digest

ec:bf:63:04:49:e5:4e:7d:04:9f:2a:b8:37:76:6a:13:5a:68:e9:c1:b4:79:09:a6:96:0f:86:11:ef:b0:e4:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1207100009841,CN=KLAUNCHER LLC,O=KLAUNCHER LLC,STREET=Zavodskaya street\, 2A kv 75,L=Donskoy,ST=Tulskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#130f54756c736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 21, 2024

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

49:40:5f:78:a7:d8:3f:07:20:d0:04:9b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 29, 2023 - Sep 29, 2024

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

9228

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegConnectRegistryW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegReplaceKeyW RegRestoreKeyW RegSaveKeyW RegSetValueExW RegUnLoadKeyW

kernel32

CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection EnumCalendarInfoW EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeEnvironmentStringsA FreeLibrary FreeResource GetACP GetCPInfo GetCPInfoExW GetCommandLineA GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStrings GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadLocale GetThreadPriority GetTickCount GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetVersion GetVersionExA GetVersionExW GetVolumeInformationW GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFindAtomW GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLocale LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MulDiv MultiByteToWideChar QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFileTime SetHandleCount SetLastError SetThreadLocale SetThreadPriority SizeofResource Sleep SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualQuery VirtualQueryEx WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW lstrlenW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winspool.drv

ClosePrinter DocumentPropertiesW EnumPrintersW ord203 OpenPrinterW

comctl32

FlatSB_GetScrollInfo FlatSB_GetScrollPos FlatSB_SetScrollInfo FlatSB_SetScrollPos FlatSB_SetScrollProp ImageList_Add ImageList_BeginDrag ImageList_Copy ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_DrawIndirect ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_GetImageInfo ImageList_LoadImageW ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetIconSize ImageList_SetImageCount ImageList_SetOverlayImage ImageList_Write ord17 InitializeFlatSB _TrackMouseEvent

comdlg32

FindTextW

gdi32

AbortDoc AddFontMemResourceEx AngleArc Arc ArcTo BitBlt Chord CombineRgn CopyEnhMetaFileW CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateDIBitmap CreateFontIndirectW CreateHalftonePalette CreateICW CreatePalette CreatePenIndirect CreateRectRgn CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject Ellipse EndDoc EndPage EnumFontFamiliesExW EnumFontsW ExcludeClipRect ExtFloodFill ExtTextOutW FrameRgn GdiFlush GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileDescriptionW GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetNearestPaletteIndex GetObjectW GetPaletteEntries GetPixel GetRgnBox GetStockObject GetStretchBltMode GetSystemPaletteEntries GetTextExtentPoint32W GetTextExtentPointW GetTextMetricsW GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt Pie PlayEnhMetaFile PolyBezier PolyBezierTo Polygon Polyline RealizePalette RectVisible Rectangle ResizePalette RestoreDC RoundRect SaveDC SelectClipRgn SelectObject SelectPalette SetAbortProc SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetDIBits SetEnhMetaFileBits SetMapMode SetPixel SetROP2 SetRectRgn SetStretchBltMode SetTextColor SetViewportOrgEx SetWinMetaFileBits SetWindowOrgEx StartDocW StartPage StretchBlt StretchDIBits UnrealizeObject

shell32

SHAppBarMessage ShellExecuteW Shell_NotifyIconW

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint BringWindowToTop CallNextHookEx CallWindowProcW CharLowerBuffW CharLowerW CharNextW CharUpperBuffW CharUpperW CheckMenuItem ChildWindowFromPoint ClientToScreen CloseClipboard CopyIcon CopyImage CreateAcceleratorTableW CreateIcon CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DefFrameProcW DefMDIChildProcW DefWindowProcW DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextExW DrawTextW EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndMenu EndPaint EnumChildWindows EnumDisplayMonitors EnumThreadWindows EnumWindows FillRect FindWindowExW FindWindowW FrameRect GetActiveWindow GetCapture GetClassInfoW GetClassLongW GetClassNameW GetClientRect GetClipboardData GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetDlgCtrlID GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextW GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameW GetKeyboardState GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoW GetMenuState GetMenuStringW GetMessageExtraInfo GetMessagePos GetMonitorInfoW GetParent GetPropW GetScrollBarInfo GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetUpdateRect GetWindow GetWindowDC GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InsertMenuItemW InsertMenuW InvalidateRect IsChild IsDialogMessageA IsDialogMessageW IsIconic IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible IsZoomed KillTimer LoadBitmapW LoadCursorW LoadIconW LoadKeyboardLayoutW LoadStringW LockWindowUpdate MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow MoveWindow MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageA PeekMessageW PostMessageW PostQuitMessage RedrawWindow RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient ScrollWindow SendMessageA SendMessageW SetActiveWindow SetCapture SetClassLongW SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowCaret ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoW TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow ValidateRect WaitMessage WindowFromPoint wsprintfA

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize IsEqualGUID OleInitialize OleUninitialize

oleaut32

GetErrorInfo SafeArrayCreate SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantInit

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryAuthSchemes WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpWriteData

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

283KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KLSetup.exe

PE Signature issue

advapi32

kernel32

version

winspool.drv

comctl32

comdlg32

gdi32

shell32

user32

ole32

oleaut32

winhttp

generic