KrampUI[.]exe | Triage

Resubmissions

11/07/2024, 14:33

240711-rwtpgszglr 3

04/07/2024, 23:22

240704-3cpf7svgll 6

Sharing

Copy URL Twitter E-mail

General

Target

KrampUI.exe
Size

16.6MB
MD5

176a5cf989ea8fe63132ff5d21abd955
SHA1

f9c9b6d97b55fd0290bff8197063e8b44989ca11
SHA256

6ec5e974eb90d4cd9b5803db261ffd0c4d7ff00ac472a3aea8cf67ea931447b7
SHA512

a89525c43b6862360a434568961f0ca1e377578583bfa31327976d3ee9ad0f1a5a18bd853d282c0733eb18516c1223ba7eca3764aeb4c7d85b62073b6198d124
SSDEEP

196608:YNLpx2XF7EPqG7dFLLefAsgvLefAs29LefAsgiL2ybi8c:YNLpx2XF7EPqGnH3sE3si3soyb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KrampUI.exe

Files

KrampUI.exe
.exe windows:6 windows x64 arch:x64

58dccfc923aa941cabe2982f04cbf63b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Pixeluted\Desktop\KrampUI\src-tauri\target\release\deps\krampui.pdb

Imports

advapi32

SystemFunction036
RegOpenKeyExW
RegQueryValueExW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegCloseKey
RegGetValueW
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation

ws2_32

getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
shutdown
setsockopt
closesocket
WSAGetLastError
WSARecv
WSASend
WSAGetOverlappedResult
WSAIoctl
getsockopt
ioctlsocket
listen
getsockname
bind
connect
send
recv
WSASocketW
getpeername

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
ReleaseMutex
CreateMutexW
GetLastError
GetModuleHandleW
GetCurrentThreadId
SleepConditionVariableSRW
SetFileCompletionNotificationModes
CancelIoEx
ReadFile
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetHandleInformation
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetNativeSystemInfo
LoadLibraryExA
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
CreateEventW
WaitForSingleObject
FormatMessageW
lstrlenW
GetUserDefaultLocaleName
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
GetEnvironmentVariableW
Sleep
GetCurrentProcess
DuplicateHandle
CreatePipe
GetFileInformationByHandle
GetConsoleMode
SetConsoleMode
GetCurrentProcessId
CreateFileW
GetProcessTimes
VirtualQueryEx
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetExitCodeProcess
LocalFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetOverlappedResult
GetStdHandle
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
SetFilePointerEx
WriteFileEx
SleepEx
TerminateProcess
GetProcessId
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapReAlloc
FindNextFileW
FindClose
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
GetFileType
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects

ntdll

NtCancelIoFileEx
NtWriteFile
RtlGetNtVersionNumbers
NtDeviceIoControlFile
NtQueryInformationProcess
NtCreateFile
NtReadFile
RtlNtStatusToDosError
RtlGetVersion
NtQuerySystemInformation

user32

EnumChildWindows
CloseClipboard
GetRawInputData
CreateIcon
DestroyIcon
RegisterWindowMessageA
GetDC
RegisterClipboardFormatW
SetWindowLongW
ShowWindow
DispatchMessageA
EmptyClipboard
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
AttachThreadInput
GetWindowTextW
GetWindowTextLengthW
GetClipboardData
SetWindowTextW
SetClipboardData
MonitorFromPoint
EnumDisplayMonitors
ToUnicodeEx
GetKeyboardLayout
RegisterHotKey
IsClipboardFormatAvailable
RegisterRawInputDevices
UnregisterHotKey
PostQuitMessage
SendInput
CreateAcceleratorTableW
AppendMenuW
CreatePopupMenu
CreateMenu
CheckMenuItem
SetMenuItemInfoW
MsgWaitForMultipleObjectsEx
DestroyAcceleratorTable
IsProcessDPIAware
SystemParametersInfoA
IsWindowVisible
AdjustWindowRectEx
SetCapture
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageA
GetWindowRect
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetAsyncKeyState
RegisterTouchWindow
GetSystemMetrics
GetForegroundWindow
GetActiveWindow
IsIconic
SetMenu
ReleaseCapture
InvalidateRgn
SetWindowPlacement
GetWindowPlacement
ChangeDisplaySettingsExW
SetWindowPos
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
TrackPopupMenu
SetCursor
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
LoadCursorW
ClientToScreen
GetClientRect
GetWindowLongW
GetKeyboardState
FlashWindowEx
DefWindowProcW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
OpenClipboard
GetUpdateRect
PeekMessageW
PostThreadMessageW
ValidateRect
RedrawWindow
SetForegroundWindow
SetWindowDisplayAffinity
IsWindow
RegisterClassW
MessageBoxW
PostMessageW
SendMessageW
CreateWindowExW
RegisterClassExW
FindWindowW
DestroyWindow
GetMenu
ShowCursor
ClipCursor
GetClipCursor
EnableMenuItem
GetSystemMenu
SetCursorPos

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass
TaskDialogIndirect

ole32

CoCreateInstance
RevokeDragDrop
CoTaskMemAlloc
CreateStreamOnHGlobal
CoUninitialize
OleInitialize
RegisterDragDrop
CoInitializeEx
CoTaskMemFree

shell32

Shell_NotifyIconGetRect
Shell_NotifyIconW
ShellExecuteW
SHGetKnownFolderPath
SHCreateItemFromParsingName
CommandLineToArgvW
DragQueryFileW
DragFinish
SHAppBarMessage

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo
SysStringLen
GetErrorInfo
SysFreeString

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

secur32

QueryContextAttributesW
AcceptSecurityContext
ApplyControlToken
EncryptMessage
FreeContextBuffer
InitializeSecurityContextW
DeleteSecurityContext
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain

pdh

PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

api-ms-win-crt-math-l1-1-0

pow
trunc
round
__setusermatherr
floor

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncmp
wcslen
strcpy_s
strlen

api-ms-win-crt-runtime-l1-1-0

strerror
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_onexit_table
__p___argc
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_crt_atexit
_seh_filter_exe
terminate
abort
__p___argv

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free
calloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 439KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

58dccfc923aa941cabe2982f04cbf63b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

kernel32

ntdll

user32

comctl32

ole32

shell32

gdi32

dwmapi

oleaut32

uxtheme

bcrypt

secur32

crypt32

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8.6MB - Virtual size: 8.6MB

.rdata Size: 7.4MB - Virtual size: 7.4MB

.data Size: 21KB - Virtual size: 33KB

.pdata Size: 439KB - Virtual size: 438KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 71KB - Virtual size: 71KB

.text
Size: 8.6MB - Virtual size: 8.6MB

.rdata
Size: 7.4MB - Virtual size: 7.4MB

.data
Size: 21KB - Virtual size: 33KB

.pdata
Size: 439KB - Virtual size: 438KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 71KB - Virtual size: 71KB