Kernel Emulator og[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Kernel Emulator og.exe
Size 2.6MB
Sample260808-pv75da1ves
SHA256 36a3201d207a2c2538c38e1f3626ab59d968bce28d98e00047087fb15cbd0d0c
MD5 7e29521bf5cb1ca6e6ead7f8ffd2ef95
SHA1 4f1321dd0df6127508e7ad627db3e3b12d3cc731
SHA512 eac254f620934d6e36cf47d34fd8327104c83a023eb71d24c10a45146a61548bcd132b8dccda9c198135cb9d04dde071378f79bcbc551fd2ea01275abc3dd606
SSDEEP 49152:4f7YKVq5i7T7XF6H12WKXgJzAeUEeoYEgKg9RKxe6+n:lUDF+2gJjXlngW
TLSH
T127D50150A2A441E8D067D1B8DDE6AA07E732740907309EEF07D09E662F67AF05F7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kernel Emulator og.exe

File Explorer

Kernel Emulator og.exe

.exe 2.6MB

Kernel Emulator og.exe

IMPHASH 9b9b4d985a0a0b6421a7f5fb3d078956
SHA256 36a3201d207a2c2538c38e1f3626ab59d968bce28d98e00047087fb15cbd0d0c
MD5 7e29521bf5cb1ca6e6ead7f8ffd2ef95
SHA1 4f1321dd0df6127508e7ad627db3e3b12d3cc731
SHA512 eac254f620934d6e36cf47d34fd8327104c83a023eb71d24c10a45146a61548bcd132b8dccda9c198135cb9d04dde071378f79bcbc551fd2ea01275abc3dd606
SSDEEP 49152:4f7YKVq5i7T7XF6H12WKXgJzAeUEeoYEgKg9RKxe6+n:lUDF+2gJjXlngW
TLSH
T127D50150A2A441E8D067D1B8DDE6AA07E732740907309EEF07D09E662F67AF05F7B712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2769408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winhttp

WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpQueryOption WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpCrackUrl WinHttpReadData

crypt32

CertFreeCertificateChain CertGetCertificateContextProperty CertGetNameStringA CertFreeCertificateContext CertGetCertificateChain

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptEncrypt BCryptGenRandom BCryptOpenAlgorithmProvider

advapi32

RegQueryValueExA OpenServiceA RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW ChangeServiceConfigW RegOpenKeyExW RegOpenKeyExA RegQueryInfoKeyA OpenProcessToken RegSetValueExA ControlService RegCreateKeyExA OpenSCManagerA OpenSCManagerW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey QueryServiceStatus ConvertSidToStringSidA CloseServiceHandle GetTokenInformation

shell32

ShellExecuteW

user32

DispatchMessageW GetAsyncKeyState ShowWindow wsprintfA RegisterClassExW GetWindowLongPtrW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW SetWindowLongPtrW GetDC DestroyWindow DefWindowProcW SetClipboardData GetClipboardData EnumWindows OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode SetLayeredWindowAttributes PeekMessageW GetWindowTextW GetCursorPos ReleaseDC SetForegroundWindow GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent TranslateMessage FindWindowW LoadCursorW UpdateLayeredWindow EmptyClipboard UnhookWinEvent UpdateWindow SetWinEventHook SystemParametersInfoW EnumDisplaySettingsW CloseClipboard ClientToScreen GetKeyState GetMessageExtraInfo GetCapture PostQuitMessage

kernel32

HeapAlloc GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc WaitForSingleObject GetExitCodeProcess CreateProcessW ReadConsoleW IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx SleepConditionVariableSRW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize IsValidCodePage GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx CreateDirectoryW ReadFile GetModuleFileNameA SetConsoleCtrlHandler GetVolumeInformationW FindFirstFileW GetFileSizeEx VirtualProtect VirtualFree FindNextFileW GetFileType WriteFile ExpandEnvironmentStringsW DeviceIoControl VirtualAlloc TerminateProcess GetModuleFileNameW CreateNamedPipeW Thread32Next ExpandEnvironmentStringsA SetErrorMode SetFilePointer Thread32First GetEnvironmentVariableA FindClose CreateFileW GetFileAttributesW GetSystemDirectoryW UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread LoadLibraryA DeleteFileA DeleteFileW Process32FirstW CloseHandle SetFileAttributesA GetLocalTime Beep GetProcAddress LocalFree GetFileSize GetCurrentProcessId GetProcessHeap GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile GetTickCount LoadLibraryExW ConnectNamedPipe CheckRemoteDebuggerPresent FlushFileBuffers OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency RtlUnwind QueryPerformanceCounter GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW AreFileApisANSI CreateFile2 SetFilePointerEx GetCurrentProcess GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA SetStdHandle HeapSize UnhandledExceptionFilter WriteConsoleW SetEndOfFile InitOnceComplete IsDBCSLeadByte

gdi32

CreateCompatibleDC CreateDIBSection SelectObject DeleteObject DeleteDC

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

iphlpapi

GetAdaptersInfo

wininet

HttpSendRequestA InternetOpenA HttpOpenRequestA InternetCloseHandle InternetConnectA InternetReadFile

gdiplus

GdipCreateBitmapFromScan0 GdipDeletePen GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics GdipFillRectangleI GdipGetImageGraphicsContext GdipSetStringFormatAlign GdiplusStartup GdipCreateStringFormat GdipDeleteFontFamily GdipResetClip GdipAddPathArcI GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipDeleteRegion GdipSetSmoothingMode GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipResetPath GdipFillPath GdipGraphicsClear GdipCreateRegionPath GdipClosePathFigure GdipSetClipRegion GdipDrawPath GdipCreatePen1 GdipSetTextRenderingHint GdipMeasureString GdipDeleteBrush GdipDisposeImage

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

853KB

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

122KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Kernel Emulator og.exe

d3d11

dwmapi

winhttp

crypt32

bcrypt

advapi32

shell32

user32

kernel32

gdi32

ole32

oleaut32

iphlpapi

wininet

gdiplus

imm32

d3dcompiler_47

generic