KORG_KeyGen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
KORG_KeyGen.exe
Size 2.4MB
Sample260922-pg3yhaea68
SHA256 6ecefaaddf2e21fca29518afd06709c2b28592e8bdcea2691a55658651f1894d
MD5 3ae11961ab75f670e21c6a31c5a29b95
SHA1 26bb47016639c70446c85ac6c697a11ad707c496
SHA512 5b1a1f13c9f27540f5ea4aaaa80c5c9aaa56d40c9040586b706cf26221c1dd4ef39f36535d5f97741762b2f703fb9276ab51c137369a8727befdb945bc7d303e
SSDEEP 49152:RZHJkjWUZhCZi8V8CeFwZQUAe6z1MD18cFpPO+wmfKU2V16mD0Qg0Q:D/5lR84JimyU250Qg0Q
TLSH
T124C5BF4B727B00E8D1BEC074DA95A60BD7B1748B0634974F15F04AAAEF177725EAE320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KORG_KeyGen.exe

File Explorer

KORG_KeyGen.exe

.exe 2.4MB

KORG_KeyGen.exe

IMPHASH 63d12dd18a5374e013a5f36a7a7561aa
SHA256 6ecefaaddf2e21fca29518afd06709c2b28592e8bdcea2691a55658651f1894d
MD5 3ae11961ab75f670e21c6a31c5a29b95
SHA1 26bb47016639c70446c85ac6c697a11ad707c496
SHA512 5b1a1f13c9f27540f5ea4aaaa80c5c9aaa56d40c9040586b706cf26221c1dd4ef39f36535d5f97741762b2f703fb9276ab51c137369a8727befdb945bc7d303e
SSDEEP 49152:RZHJkjWUZhCZi8V8CeFwZQUAe6z1MD18cFpPO+wmfKU2V16mD0Qg0Q:D/5lR84JimyU250Qg0Q
TLSH
T124C5BF4B727B00E8D1BEC074DA95A60BD7B1748B0634974F15F04AAAEF177725EAE320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1816740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetEvent GetCurrentThread TerminateThread QueryPerformanceFrequency CloseHandle LoadLibraryW GetCurrentDirectoryW GetProcAddress DeleteCriticalSection ExitProcess GetModuleHandleW FreeLibrary QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter GetCommandLineW AttachConsole LoadLibraryA CompareStringOrdinal GlobalSize GlobalAlloc GetFileAttributesExW GlobalLock GetCurrentProcessId GlobalUnlock SetThreadAffinityMask InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetTickCount64 SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleFileNameW TerminateProcess OutputDebugStringW GetLastError FormatMessageW Sleep CreateEventW ReadFile TryEnterCriticalSection SetPriorityClass EnterCriticalSection GetCurrentProcess GetModuleHandleExW GetModuleHandleA ResumeThread ReleaseMutex GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject GetLocaleInfoW CreateMutexW SetFilePointer InitializeCriticalSection LeaveCriticalSection SetThreadPriority WaitForMultipleObjects

user32

DispatchMessageW RegisterClassExW GetWindowLongPtrW UnregisterClassW CreateWindowExW SetWindowLongPtrW DestroyWindow GetFocus SendMessageTimeoutW GetMessageW GetWindowLongW GetSystemMenu GetMessageExtraInfo GetMessagePos MapVirtualKeyW GetWindowRect GetDC IsWindowVisible SetWindowPos GetDpiForWindow EnumChildWindows EnumDisplayMonitors SendMessageW CallNextHookEx SetWindowTextW MessageBeep WindowFromPoint GetWindowPlacement DestroyCursor GetKeyboardState SetCaretPos GetActiveWindow ShowWindow IsWindow GetAsyncKeyState PostMessageW GetCapture RedrawWindow DestroyIcon VkKeyScanW GetWindowInfo GetMonitorInfoW CreateIconIndirect CloseClipboard EmptyClipboard IsChild CreateCaret MapWindowPoints TrackMouseEvent GetForegroundWindow UnhookWindowsHookEx GetMessageTime SetLayeredWindowAttributes BringWindowToTop GetClipboardData EnumDisplayDevicesW LoadCursorW DestroyCaret SetCapture SetWindowsHookExW SetClipboardData ToUnicode SetCursor SetWindowLongW GetSystemMetricsForDpi GetClientRect UpdateLayeredWindow ShowCaret GetDesktopWindow EnumDisplaySettingsW EnableMenuItem GetParent ReleaseCapture InvalidateRect DefWindowProcW SystemParametersInfoW ValidateRect ValidateRgn MonitorFromWindow GetUpdateRgn EndPaint BeginPaint GetCursorPos SetCursorPos GetAncestor AttachThreadInput GetWindowThreadProcessId GetWindowTextW TranslateMessage SendNotifyMessageW SetFocus EnumWindows OpenClipboard ReleaseDC PeekMessageW

gdi32

GetRegionData SetMapperFlags DeleteDC CreateRectRgn CreateCompatibleDC SelectObject CombineRgn CreateBitmap RestoreDC DeleteObject ExcludeClipRect GetDeviceCaps CreateRectRgnIndirect StretchDIBits StretchBlt CreateDIBSection SaveDC BitBlt SetBrushOrgEx SetMapMode SetStretchBltMode CreateFontIndirectW

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA GetUserNameW

shell32

SHGetSpecialFolderPathA DragQueryFileW ExtractAssociatedIconW

ole32

CoCreateInstance OleInitialize RevokeDragDrop RegisterDragDrop OleUninitialize

oleaut32

SafeArrayDestroy SysAllocString SafeArrayPutElement SafeArrayUnaccessData SafeArrayCreateVector SafeArrayAccessData

msvcp140

?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_do_broadcast_at_thread_exit _Thrd_join ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Cnd_broadcast _Mtx_unlock _Query_perf_counter _Thrd_id _Cnd_wait _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Thrd_yield

winmm

timeGetTime timeBeginPeriod

dbghelp

MakeSureDirectoryPathExists

d2d1

ord1

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

imm32

ImmNotifyIME ImmSetCandidateWindow ImmAssociateContext ImmGetCompositionStringW ImmReleaseContext ImmGetContext ImmAssociateContextEx

comctl32

ord413 ord410 ord412

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp __RTtypeid strchr strstr __C_specific_handler longjmp _purecall __std_type_info_compare __std_exception_copy __std_exception_destroy __std_terminate _CxxThrowException __RTDynamicCast memmove memset __intrinsic_setjmp __current_exception_context __current_exception

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func freopen_s fflush _set_fmode __stdio_common_vsscanf fread fputs fwrite __p__commode __stdio_common_vsprintf fclose _fileno fputc fopen __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free calloc _callnewh realloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _initterm _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e exit _endthreadex _get_narrow_winmain_command_line _fpreset terminate _set_app_type _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-time-l1-1-0

_ftime64_s

api-ms-win-crt-string-l1-1-0

strncmp strncpy iswdigit iswalpha iswspace strcmp towupper towlower iswalnum

api-ms-win-crt-convert-l1-1-0

mbstowcs _strtod_l atoi _atoi64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _create_locale

api-ms-win-crt-math-l1-1-0

floor sin atan2f sqrt ceil ceilf exp pow acos _hypotf fmod cosf tanf floorf cos __setusermatherr sqrtf _hypot _fdclass _dclass sinf truncf

api-ms-win-crt-environment-l1-1-0

getenv