Kernel Injector Usermode[.]exe

General

Target
Kernel Injector Usermode.exe
Size 380KB
Sample261022-zvmtjsbe65
SHA256 b78af8225dcea8948e321cebf9971daa1804b8a9b5e3bae908ebd86b4025c78c
MD5 ce6b41c55c076fe7458b5da94919a4d5
SHA1 e5acaba312bb14dcb34dcf065bfa6a851ebf9170
SHA512 6a8962b32af0cbc576920ee14d4b40568d0552a988b4144545a3f13d12b8f0440e8af8be38898f0bb76eef6bd3753b8b3322b8c3dc47b91bc971e923327bca2b
SSDEEP 6144:6CA7r6oGBO4GFpd91XGaWelGwzbohRZltEfz4rJgFWAZ4JBZN4RYwX:wr6o94GFpP1ZWVzhRZ0f2nAIfN4Rf
TLSH
T162849E26F7A504FCE0A79238CC665A06E7B2BC4A07609BCF23F146562F176E05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kernel Injector Usermode.exe

File Explorer

Kernel Injector Usermode.exe

.exe 380KB

Kernel Injector Usermode.exe

IMPHASH 7eae4a0268d848d8702a616b914141d3
SHA256 b78af8225dcea8948e321cebf9971daa1804b8a9b5e3bae908ebd86b4025c78c
MD5 ce6b41c55c076fe7458b5da94919a4d5
SHA1 e5acaba312bb14dcb34dcf065bfa6a851ebf9170
SHA512 6a8962b32af0cbc576920ee14d4b40568d0552a988b4144545a3f13d12b8f0440e8af8be38898f0bb76eef6bd3753b8b3322b8c3dc47b91bc971e923327bca2b
SSDEEP 6144:6CA7r6oGBO4GFpd91XGaWelGwzbohRZltEfz4rJgFWAZ4JBZN4RYwX:wr6o94GFpP1ZWVzhRZ0f2nAIfN4Rf
TLSH
T162849E26F7A504FCE0A79238CC665A06E7B2BC4A07609BCF23F146562F176E05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

91044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RIUM.pdb

kernel32

GetLastError DeviceIoControl CreateFileA FileTimeToSystemTime CloseHandle GetModuleFileNameA CreateDirectoryA Sleep LoadLibraryA FreeLibrary ReadFile VirtualFree VirtualAlloc CreateToolhelp32Snapshot Process32NextW GetProcAddress GetFileSize SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

user32

MessageBoxA

ntdll

RtlImageNtHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

258KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kernel Injector Usermode.exe

kernel32

user32

ntdll

generic