KellerServices[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
KellerServices.exe
Size 3.2MB
Sample260804-3yd8csfr7w
SHA256 c8f2c4d510972ce63bc36d56515578b36d52be9b09fecd1a47128975eac8000e
MD5 aa81f96ea188c5db2ef9220ff4c724b8
SHA1 3cdb02d589230c805c92beb3d835c503ef252c95
SHA512 97634890f296e44e66ab6d64d185bd76f07b189340f31508b32460e67b7acb750655423b86d2422fb4f40d70bceeeb1e23cb01bcc709e846ba43751383fa8f9f
SSDEEP 49152:WuBzJFDxeXh6DxUqi3mx4y3VkT8+HE1uxuMvAKrTZrNyAcw2dqhT8pLJnv9mU/h:WuruXh0UKjVmxdAGTZ0J3H97/h
TLSH
T1CBF5E086E1978768DF625B3C45849737C2B03CCA43A093D36AED4A746F639F86A7C740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KellerServices.exe

File Explorer

KellerServices.exe

.exe 3.2MB

KellerServices.exe

IMPHASH ac22a20f9c21e83c0b72e9b58908b67a
SHA256 c8f2c4d510972ce63bc36d56515578b36d52be9b09fecd1a47128975eac8000e
MD5 aa81f96ea188c5db2ef9220ff4c724b8
SHA1 3cdb02d589230c805c92beb3d835c503ef252c95
SHA512 97634890f296e44e66ab6d64d185bd76f07b189340f31508b32460e67b7acb750655423b86d2422fb4f40d70bceeeb1e23cb01bcc709e846ba43751383fa8f9f
SSDEEP 49152:WuBzJFDxeXh6DxUqi3mx4y3VkT8+HE1uxuMvAKrTZrNyAcw2dqhT8pLJnv9mU/h:WuruXh0UKjVmxdAGTZ0J3H97/h
TLSH
T1CBF5E086E1978768DF625B3C45849737C2B03CCA43A093D36AED4A746F639F86A7C740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

784128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\LuxNew\storm-inj\x64\Release\KellerServices.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

LoadLibraryA QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter ReadFile WriteProcessMemory SetHandleInformation CreatePipe WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Process32NextW Process32FirstW VirtualAllocEx CreateRemoteThread CreateProcessA VirtualFreeEx IsWow64Process GetSystemInfo ReadProcessMemory VirtualQueryEx DeleteFileA Beep GetModuleHandleW TerminateProcess DeviceIoControl CreateFileA LocalFree FormatMessageA GetFileSizeEx HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx SleepConditionVariableSRW Sleep GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTempPathA GetSystemTimeAsFileTime GetLocalTime FileTimeToLocalFileTime CloseHandle FileTimeToSystemTime TzSpecificLocalTimeToSystemTime GetLastError GetTickCount64 SetSystemTime GetCurrentProcess GetLocaleInfoA AcquireSRWLockExclusive

user32

MoveWindow TranslateMessage PostQuitMessage GetActiveWindow ShowWindow GetKeyState DefWindowProcW GetWindowRect PeekMessageW GetMessageExtraInfo DispatchMessageW GetSystemMetrics ScreenToClient GetCapture ClientToScreen TrackMouseEvent CreateWindowExW GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CloseServiceHandle OpenSCManagerA QueryServiceStatusEx OpenServiceA GetTokenInformation

shell32

ShellExecuteW

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z _Mtx_lock _Mtx_unlock ?_Xbad_alloc@std@@YAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr __std_exception_destroy __std_exception_copy _CxxThrowException __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception memcmp memchr memset memmove memcpy strrchr longjmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _exit terminate _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit exit _beginthreadex abort _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode _get_stream_buffer_pointers __stdio_common_vsprintf_s __p__commode fputc fflush __stdio_common_vsscanf __stdio_common_vsprintf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell fgetc _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

tolower strncmp strncpy _wcsicmp wcslen strlen strcmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

powf sinf cosf ceilf sqrtf acosf fmodf __setusermatherr