Kainite[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Kainite.exe
Size

284KB
MD5

22168862e19c748e45bc0a68c5790929
SHA1

3484855315c0b406ca5531753ac08f0bc52bd518
SHA256

0c9040d4c71d0fc6eaf65a690321bf4b39fa928106bc820cd0e1bfa2b32b6a59
SHA512

457437ea26ca4b2ef4ef6984b55d36100ee6bc531abbdd57553ac3ad214979a3a6936db6629e7cb66934cd9d45883693963ee49a1d3df2536b0538b91c9a5fd2
SSDEEP

6144:AV6eZwOU8zjEKYGVdQ0JkaV0fgPvtliisXnufO8lt:06r+rB/3eE0fgUXng

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kainite.exe

Files

Kainite.exe
.exe windows:6 windows x64 arch:x64

da3e365a1bebf619da4ce35cf6b7d58c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\jacob\Downloads\dxD4CtWC9f+-+discord+invite\ioctl base updated by redshirtfan\build\usermode\usermode.pdb

Imports

d3d9

Direct3DCreate9Ex

kernel32

GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
Process32First
DeviceIoControl
CreateFileW
CreateToolhelp32Snapshot
Process32Next
CloseHandle
CreateThread
lstrcmpiA
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GlobalFree
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
ReleaseSRWLockExclusive
GlobalAlloc
AcquireSRWLockExclusive
UnhandledExceptionFilter

user32

LoadIconA
TranslateMessage
SetLayeredWindowAttributes
GetWindow
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
PeekMessageA
GetDesktopWindow
RegisterClassExA
UpdateWindow
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
SendInput
GetKeyState
LoadCursorA
ScreenToClient
GetActiveWindow
ClientToScreen

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memset
__C_specific_handler
memcpy
__current_exception
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
memchr
__current_exception_context
memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
fseek
fclose
fflush
__acrt_iob_func
fwrite
ftell
_wfopen
fread
__stdio_common_vsscanf
__stdio_common_vfprintf
_set_fmode
__p__commode
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncpy
isprint
strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
exit
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
terminate
_exit
_set_app_type
_seh_filter_exe
_cexit
_configure_narrow_argv
_crt_atexit
_c_exit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-math-l1-1-0

powf
cosf
pow
fmodf
__setusermatherr
sinf
sqrt
ceilf
asin
atan2
sqrtf
floorf
tanf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da3e365a1bebf619da4ce35cf6b7d58c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

kernel32

user32

imm32

msvcp140

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 225KB - Virtual size: 225KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 412B

.text
Size: 225KB - Virtual size: 225KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 412B