KVRT[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KVRT.exe
Size 115.7MB
Sample260809-gz4nrasbpf
SHA256 13c814facec321cac743d1e56e051784df524700d63fa66a82fe72c44dac2728
MD5 efdf45b600149f9ee15549a5c1566030
SHA1 ca0e69932bf2646288d06b86a2eadb58a3bdde95
SHA512 565d01b30bc65ce392082898c598defed24f87704312d550fdd77871a0123a723fbbf21e94579c259b7af598de0f7dd076fa0a26af4df8e7a442eb42e4540524
SSDEEP 1572864:lefiOgxx4wFWhp/PLysnUiJUlb/NH2bIo+w0KkqKqBODmxaskkJeedXNXS:lCiOg3lWZzTUiJUNNn/qkO0skShdS
TLSH
T16B483320F5D144B3F522613056E9AB2A5F3D78660321C9CF63B853795F32AE27B36362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

KVRT.exe

.exe 115.7MB

KVRT.exe

IMPHASH 868dc92668ff4b0d0241716d6769d9c6
SHA256 13c814facec321cac743d1e56e051784df524700d63fa66a82fe72c44dac2728
MD5 efdf45b600149f9ee15549a5c1566030
SHA1 ca0e69932bf2646288d06b86a2eadb58a3bdde95
SHA512 565d01b30bc65ce392082898c598defed24f87704312d550fdd77871a0123a723fbbf21e94579c259b7af598de0f7dd076fa0a26af4df8e7a442eb42e4540524
SSDEEP 1572864:lefiOgxx4wFWhp/PLysnUiJUlb/NH2bIo+w0KkqKqBODmxaskkJeedXNXS:lCiOg3lWZzTUiJUNNn/qkO0skShdS
TLSH
T16B483320F5D144B3F522613056E9AB2A5F3D78660321C9CF63B853795F32AE27B36362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

84:fe:15:80:a2:57:46:7d:ca:4e:49:5d:0b:c6:b7:50:ca:f2:fb:2f:60:cb:27:03:c6:dd:df:1d:34:69:78:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoye\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 9, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

12:ec:1d:79:45:83:1a:2a:59:69:f4:68

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 22, 2023 - Aug 22, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

410768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\c\d_00000000\s\product\removal_tools\output\out_Win32\Release\setup_kvrt.pdb

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

LocalFree ReadFile GetFileSizeEx GetCurrentProcess WriteFile SetFileTime SetEndOfFile GetTempPathW CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW SetFilePointerEx GetFileTime FlushFileBuffers CreateDirectoryW GetVolumeInformationW FindFirstFileExW GetFullPathNameW FindNextFileW RemoveDirectoryW FindClose GetModuleHandleA GetDiskFreeSpaceExW GetCurrentDirectoryW GetDriveTypeW GetSystemDefaultLangID GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount WideCharToMultiByte MultiByteToWideChar InterlockedExchange GetModuleHandleExW GetVersionExW GetSystemWindowsDirectoryA GetTimeZoneInformation FileTimeToSystemTime LoadLibraryA RaiseException GetSystemInfo FileTimeToLocalFileTime DecodePointer GetWindowsDirectoryW VerSetConditionMask GetComputerNameW SystemTimeToFileTime VerifyVersionInfoW GetSystemWindowsDirectoryW ProcessIdToSessionId GetCurrentProcessId CreateEventW SetEvent GetStartupInfoW WaitForMultipleObjects WaitForSingleObject GetCommandLineW CopyFileW AttachConsole FreeLibrary Sleep GetTickCount SizeofResource LockResource LoadResource FindResourceW GetOEMCP GetACP IsValidCodePage PeekNamedPipe GetFileType GetExitCodeProcess OpenProcess SetHandleInformation GetStdHandle CreatePipe DuplicateHandle SearchPathA CreateProcessA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapSize ExitProcess SetStdHandle GetConsoleCP ExitThread RtlUnwind LoadLibraryW UnregisterWaitEx QueryDepthSList SetEnvironmentVariableA InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA ReadConsoleW GetConsoleMode VirtualFree VirtualProtect VirtualAlloc LoadLibraryExW GetModuleFileNameW FreeLibraryAndExitThread CreateSemaphoreW GetModuleHandleW GetProcAddress HeapDestroy CloseHandle HeapReAlloc WaitForSingleObjectEx GetLastError GetCurrentThreadId ReleaseSemaphore HeapCreate GetProcessHeap DeleteCriticalSection HeapAlloc InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree WriteConsoleW CreateProcessW TryEnterCriticalSection SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes

user32

GetWindowRect PostMessageW WaitForInputIdle MessageBoxW SendMessageW EndDialog IsWindow MessageBoxA MoveWindow GetClientRect GetDlgItem DialogBoxParamW GetSystemMetrics SetWindowPos SetWindowTextW

shell32

CommandLineToArgvW

ole32

CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString SysStringLen VariantClear VariantInit

advapi32

RegCloseKey RegOpenKeyExW GetUserNameW RegQueryValueExW SetSecurityDescriptorDacl SetFileSecurityW ConvertSecurityDescriptorToStringSecurityDescriptorW CreateWellKnownSid SetSecurityDescriptorSacl IsValidSecurityDescriptor OpenProcessToken GetFileSecurityW InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAceEx GetTokenInformation

Sharing

General

Malware Config

Signatures

File Explorer

KVRT.exe

version

kernel32

user32

shell32

ole32

oleaut32

advapi32

generic