KellerServices[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
KellerServices.exe
Size 3.2MB
Sample261014-cd4dmset5v
SHA256 14744c752c4766e9a424099f9768efe8c5d7446e21f75aaf6b9b3d7234eac1eb
MD5 7652443c37327118bc2d7a09de40158d
SHA1 0ba4a991fad8d03d644859b23f98ed6022fe79ef
SHA512 86797b5966f85fd981d8e11b4832e5dddc801fd4eba77030fe70a34193fbaee54d626b7f8fa124489c2e9847be4c3b0fc07e9a30928898bd3fb179f6300eb26d
SSDEEP 49152:8umbaGq78YKj6UPy3Y4y3VkT8+HE1uxuMvAKrTZrNyAcw2dqhT8pLBnYU:8ufuY3UhjVmxdAGTZ0J39
TLSH
T1D4F5E086E1978768DF625B3C45849737D2B03CCA43A093D36AED4A746F639F86A7C700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KellerServices.exe

File Explorer

KellerServices.exe

.exe 3.2MB

KellerServices.exe

IMPHASH ac22a20f9c21e83c0b72e9b58908b67a
SHA256 14744c752c4766e9a424099f9768efe8c5d7446e21f75aaf6b9b3d7234eac1eb
MD5 7652443c37327118bc2d7a09de40158d
SHA1 0ba4a991fad8d03d644859b23f98ed6022fe79ef
SHA512 86797b5966f85fd981d8e11b4832e5dddc801fd4eba77030fe70a34193fbaee54d626b7f8fa124489c2e9847be4c3b0fc07e9a30928898bd3fb179f6300eb26d
SSDEEP 49152:8umbaGq78YKj6UPy3Y4y3VkT8+HE1uxuMvAKrTZrNyAcw2dqhT8pLBnYU:8ufuY3UhjVmxdAGTZ0J39
TLSH
T1D4F5E086E1978768DF625B3C45849737D2B03CCA43A093D36AED4A746F639F86A7C700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

784112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\rebrands\Vidal Storm\injector-rlk\x64\Release\KellerServices.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

LoadLibraryA QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter ReadFile WriteProcessMemory SetHandleInformation CreatePipe WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Process32NextW Process32FirstW VirtualAllocEx CreateRemoteThread CreateProcessA VirtualFreeEx IsWow64Process GetSystemInfo ReadProcessMemory VirtualQueryEx DeleteFileA Beep GetModuleHandleW TerminateProcess DeviceIoControl CreateFileA LocalFree FormatMessageA GetFileSizeEx HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx SleepConditionVariableSRW Sleep GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetTempPathA GetSystemTimeAsFileTime GetLocalTime FileTimeToLocalFileTime CloseHandle FileTimeToSystemTime TzSpecificLocalTimeToSystemTime GetLastError GetTickCount64 SetSystemTime GetCurrentProcess GetLocaleInfoA AcquireSRWLockExclusive

user32

MoveWindow TranslateMessage PostQuitMessage GetActiveWindow ShowWindow GetKeyState DefWindowProcW GetWindowRect PeekMessageW GetMessageExtraInfo DispatchMessageW GetSystemMetrics ScreenToClient GetCapture ClientToScreen TrackMouseEvent CreateWindowExW GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CloseServiceHandle OpenSCManagerA QueryServiceStatusEx OpenServiceA GetTokenInformation

shell32

ShellExecuteW

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z _Mtx_lock _Mtx_unlock ?_Xbad_alloc@std@@YAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr __std_exception_destroy __std_exception_copy _CxxThrowException __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception memcmp memchr memset memmove memcpy strrchr longjmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _exit terminate _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit exit _beginthreadex abort _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode _get_stream_buffer_pointers __stdio_common_vsprintf_s __p__commode fputc fflush __stdio_common_vsscanf __stdio_common_vsprintf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell fgetc _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

tolower strncmp strncpy _wcsicmp wcslen strlen strcmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

powf sinf cosf ceilf sqrtf acosf fmodf __setusermatherr