Kian-Color-ShadowGarden[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Kian-Color-ShadowGarden.exe
Size 10.0MB
Sample260802-yc2djsfk2w
SHA256 b5b5f16b0de466644457670be44a4ce7a788a00450da79c44579e89b2fbec72a
MD5 469125f20ca9e3094266012bed5564cd
SHA1 ab9209320a84b526bd132dc3edeacf0d3b5fae67
SHA512 de3bd6026feda299bbb4ba265bca0c02805231be1cafc54513927e1aab05510655f3d5cb3e0032c73dfdacde185569db6ff63449e060179b7afb1dd39ae7379a
SSDEEP 98304:kOMh/yK/q63mEJhkQPmT+Woxui/xvxYx3:kOI/yD63mEJGjFU5pM
TLSH
T19EB6BFA9A2B900E9DF668278C6865223E372BCD507B057CB1A5856F50F63FE01F7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kian-Color-ShadowGarden.exe

File Explorer

Kian-Color-ShadowGarden.exe

.exe 10.0MB

Kian-Color-ShadowGarden.exe

IMPHASH 72ab3d8c27fe93c82b5b0c1623a787d2
SHA256 b5b5f16b0de466644457670be44a4ce7a788a00450da79c44579e89b2fbec72a
MD5 469125f20ca9e3094266012bed5564cd
SHA1 ab9209320a84b526bd132dc3edeacf0d3b5fae67
SHA512 de3bd6026feda299bbb4ba265bca0c02805231be1cafc54513927e1aab05510655f3d5cb3e0032c73dfdacde185569db6ff63449e060179b7afb1dd39ae7379a
SSDEEP 98304:kOMh/yK/q63mEJhkQPmT+Woxui/xvxYx3:kOI/yD63mEJGjFU5pM
TLSH
T19EB6BFA9A2B900E9DF668278C6865223E372BCD507B057CB1A5856F50F63FE01F7E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4492004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

dwmapi

DwmExtendFrameIntoClientArea

d3dcompiler_43

D3DCompile

ntdll

RtlUnwindEx RtlPcToFileHeader RtlUnwind RtlCaptureContext RtlLookupFunctionEntry

iphlpapi

GetAdaptersInfo

crypt32

CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore

ws2_32

WSASocketA sendto recvfrom listen bind accept __WSAFDIsSet getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr htons htonl gethostbyname WSASetLastError inet_pton getnameinfo freeaddrinfo closesocket WSASocketW WSAGetLastError WSACleanup WSAStartup socket shutdown setsockopt send select recv ntohs getsockopt getsockname getpeername ioctlsocket connect getaddrinfo

kernel32

ReadFile FlsFree FlsSetValue SetFilePointerEx GetConsoleOutputCP GetModuleFileNameW IsProcessorFeaturePresent FlsGetValue MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter OpenEventA SetConsoleTitleA GetCurrentProcess TerminateProcess CreateMutexA ReleaseMutex UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW SetEvent Process32FirstW CloseHandle LocalFree ExitProcess GetConsoleWindow OpenFileMappingA QueryFullProcessImageNameW MapViewOfFile GetTickCount AllocConsole SetUnhandledExceptionFilter GetEnvironmentVariableW GetTempPathW DeleteFileA DeleteFileW LoadLibraryW GetWindowsDirectoryW WriteFile CreateFileW HeapFree HeapAlloc GetProcessHeap GetModuleHandleW WaitForSingleObject CreateThread IsDebuggerPresent GetSystemInfo GetComputerNameA SetLastError ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FormatMessageA GetStdHandle GetFileType RtlVirtualUnwind VirtualProtect VirtualFree GetModuleHandleExW GetCurrentProcessId GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiberEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemTime SystemTimeToFileTime GetACP ConvertFiberToThread ConvertThreadToFiberEx FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW EncodePointer InitializeCriticalSectionEx InitOnceComplete InitOnceBeginInitialize WaitForSingleObjectEx GetTickCount64 TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime GetStartupInfoW InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW FlsAlloc FreeLibraryAndExitThread FileTimeToSystemTime ExitThread SetConsoleCtrlHandler GetDriveTypeW GetFileInformationByHandle PeekNamedPipe InitializeSRWLock GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW HeapSize UnhandledExceptionFilter LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx HeapReAlloc GetTimeZoneInformation SetStdHandle GetCurrentDirectoryW GetFullPathNameW SystemTimeToTzSpecificLocalTime SetEndOfFile DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RaiseException FindFirstFileExW

user32

UnregisterClassW RegisterClassExW DispatchMessageW SetLayeredWindowAttributes CreateWindowExW PostQuitMessage UpdateWindow GetSystemMetrics GetAsyncKeyState TranslateMessage SetWindowRgn SetWindowPos IsWindowVisible GetClassNameA ShowWindow PeekMessageW RegisterHotKey DestroyWindow MessageBoxA EnumWindows GetWindowTextA GetKeyState GetMessageExtraInfo ScreenToClient GetWindowRect DefWindowProcW IsIconic GetWindowThreadProcessId GetWindowLongPtrA ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetWindowLongA RegisterDeviceNotificationW GetWindowLongPtrW SetWindowLongPtrW UnregisterHotKey GetProcessWindowStation GetUserObjectInformationW FindWindowA MessageBoxW GetCapture

gdi32

CreateRoundRectRgn

advapi32

DeregisterEventSource CryptSignHashW CryptDestroyHash CryptCreateHash GetTokenInformation RegQueryValueExW ConvertSidToStringSidW RegOpenKeyExW CryptDecrypt CryptExportKey OpenProcessToken RegSetValueExW RegCreateKeyExW CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext RegCloseKey RegOpenKeyExA RegQueryValueExA CryptAcquireContextW RegisterEventSourceW ReportEventW CryptEnumProvidersW

shell32

ShellExecuteW

ole32

CoSetProxyBlanket CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

hid

HidD_GetHidGuid HidD_GetAttributes

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kian-Color-ShadowGarden.exe

d3d11

dwmapi

d3dcompiler_43

ntdll

iphlpapi

crypt32

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

hid

setupapi

generic