KrampUI[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

KrampUI.exe
Size

11.8MB
MD5

f9b88129bbd3412b79f13239fe7f0229
SHA1

13d1507d6b276b7b5fd8bfc740df8eaa9060f750
SHA256

edd62eec954c3aacb37918b8002b94ffbb07d48fae55762187ec15042eb0de6b
SHA512

5ff6c48398d7ef05d56509c1862ead1cf8934d15261483ba0a15fde0611fce4744dfd2cff4bc7e83f81f3655705173c2ec9c7a95468399ac738138a7cf3d471a
SSDEEP

196608:W7pHGphVDKEd5tcbULeqUkm+nk97KUv36qlEC:W7pHGphVDKEd4bo7zqlE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KrampUI.exe

Files

KrampUI.exe
.exe windows:6 windows x64 arch:x64

faf6649eb2d5e25d74dae57863e4da67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Projects\KrampUI\src-tauri\target\release\deps\krampui.pdb

Imports

advapi32

SystemFunction036
RegOpenKeyExW
RegQueryValueExW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegCloseKey
RegGetValueW
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
GetTokenInformation

ws2_32

getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
shutdown
setsockopt
closesocket
WSAGetLastError
WSARecv
WSASend
WSAGetOverlappedResult
WSAIoctl
getsockopt
ioctlsocket
listen
getsockname
bind
connect
send
recv
WSASocketW
getpeername

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
CreateMutexA
WaitForSingleObjectEx
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleW
CloseHandle
GetCurrentThreadId
ReleaseMutex
CreateMutexW
GetLastError
SleepConditionVariableSRW
SetFileCompletionNotificationModes
CancelIoEx
ReadFile
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetHandleInformation
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetNativeSystemInfo
LoadLibraryExA
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
CreateEventW
WaitForSingleObject
FormatMessageW
lstrlenW
GetUserDefaultLocaleName
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
LoadLibraryExW
GetEnvironmentVariableW
Sleep
GetCurrentProcess
DuplicateHandle
CreatePipe
LocalFree
GetOverlappedResult
GetFileInformationByHandle
GetConsoleMode
SetConsoleMode
CreateFileW
GetCurrentProcessId
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetProcessTimes
GetExitCodeProcess
VirtualQueryEx
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetStdHandle
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
SetFilePointerEx
WriteFileEx
SleepEx
TerminateProcess
GetProcessId
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapReAlloc
FindNextFileW
FindClose
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
GetFileType
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects

ntdll

NtCancelIoFileEx
RtlGetVersion
NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtQuerySystemInformation
NtQueryInformationProcess
NtReadFile
RtlGetNtVersionNumbers

user32

SendInput
SetForegroundWindow
TrackPopupMenu
PostQuitMessage
GetKeyboardState
GetAsyncKeyState
GetKeyState
MapVirtualKeyExW
GetRawInputData
IsProcessDPIAware
AppendMenuW
SystemParametersInfoA
IsWindowVisible
AdjustWindowRectEx
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
AttachThreadInput
OpenClipboard
IsClipboardFormatAvailable
GetWindowRect
VkKeyScanW
CreateAcceleratorTableW
SetWindowDisplayAffinity
GetMenu
EnumDisplayMonitors
GetClipboardData
ShowCursor
ClipCursor
DestroyAcceleratorTable
GetClipCursor
EnableMenuItem
MonitorFromPoint
SetWindowTextW
GetSystemMenu
GetWindowTextLengthW
GetWindowTextW
EmptyClipboard
SetWindowLongW
DestroyIcon
CreateIcon
CreatePopupMenu
CreateMenu
UnregisterHotKey
RegisterHotKey
GetKeyboardLayout
ToUnicodeEx
DispatchMessageA
CheckMenuItem
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageA
SendMessageW
RegisterClassExW
FindWindowW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterWindowMessageA
EnumChildWindows
RegisterTouchWindow
GetSystemMetrics
InvalidateRgn
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
DefWindowProcW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
SetCursorPos
GetForegroundWindow
IsIconic
FlashWindowEx
GetActiveWindow
SetMenu
ReleaseCapture
SetWindowPos
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
SetMenuItemInfoW
SetCursor
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
DestroyWindow
TrackMouseEvent
PostMessageW
MonitorFromRect
LoadCursorW
ClientToScreen
GetClientRect
GetWindowLongW
SetCapture
GetUpdateRect
PeekMessageW
PostThreadMessageW
ValidateRect
RegisterClipboardFormatW
RedrawWindow
IsWindow
CreateWindowExW
RegisterClassW
CloseClipboard
GetDC
SetClipboardData
ShowWindow

comctl32

DefSubclassProc
RemoveWindowSubclass
SetWindowSubclass
TaskDialogIndirect

ole32

CoUninitialize
CoTaskMemAlloc
CoCreateInstance
RevokeDragDrop
OleInitialize
RegisterDragDrop
CoTaskMemFree
CoInitializeEx
CreateStreamOnHGlobal

shell32

ShellExecuteW
DragFinish
SHGetKnownFolderPath
SHAppBarMessage
DragQueryFileW
SHCreateItemFromParsingName
CommandLineToArgvW
Shell_NotifyIconW
Shell_NotifyIconGetRect

gdi32

DeleteObject
GetDeviceCaps
CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo
SysStringLen
GetErrorInfo
SysFreeString

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

secur32

DecryptMessage
EncryptMessage
FreeContextBuffer
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
ApplyControlToken

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateChain
CertDuplicateStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy

pdh

PdhAddEnglishCounterW
PdhCloseQuery
PdhOpenQueryA
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

pow
trunc
__setusermatherr
round
floor

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncmp
wcslen
strcpy_s
strlen

api-ms-win-crt-runtime-l1-1-0

strerror
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_onexit_table
__p___argc
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_crt_atexit
_set_app_type
_seh_filter_exe
terminate
abort
__p___argv

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
free
calloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

faf6649eb2d5e25d74dae57863e4da67

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

kernel32

ntdll

user32

comctl32

ole32

shell32

gdi32

dwmapi

oleaut32

uxtheme

bcrypt

secur32

crypt32

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7.0MB - Virtual size: 7.0MB

.rdata Size: 4.4MB - Virtual size: 4.4MB

.data Size: 13KB - Virtual size: 25KB

.pdata Size: 372KB - Virtual size: 372KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 58KB - Virtual size: 58KB

.text
Size: 7.0MB - Virtual size: 7.0MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 13KB - Virtual size: 25KB

.pdata
Size: 372KB - Virtual size: 372KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 58KB - Virtual size: 58KB