Kainite Emulator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Kainite Emulator.exe
Size 18.1MB
Sample261113-3s228sts4m
SHA256 695e07ed4bf624ddfb83e56975cc5d388e7dca1836645f2386c40fff592ace26
MD5 d77f8485c9d4bf31c46be03ee8351580
SHA1 8ea639336fa769194a0a54563d9aad47f67ffb16
SHA512 eafe228de329b81eea388b3b265e53db1a351425c6580afa701aa777d094e2ab28188e2a72883989b108b4e36a8cac02da9f4112497f817bd98606816d827bd7
SSDEEP 98304:YzroElDFDyyHHQjnC3+xd+z2GcJciWCLT8TgeGbg5kAgCgHYyARvgbi0QNSLQb:y1DFDyadAJciWCLBe22kApgHdFQALQ
TLSH
T1C817BE03FB425ADCD03AD57042A5B363B3617808873456EB17C2AE285E67FD05E7BB89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kainite Emulator.exe

File Explorer

Kainite Emulator.exe

.exe 18.1MB

Kainite Emulator.exe

IMPHASH 6a14187819ffda1814f3b1cc677c0c99
SHA256 695e07ed4bf624ddfb83e56975cc5d388e7dca1836645f2386c40fff592ace26
MD5 d77f8485c9d4bf31c46be03ee8351580
SHA1 8ea639336fa769194a0a54563d9aad47f67ffb16
SHA512 eafe228de329b81eea388b3b265e53db1a351425c6580afa701aa777d094e2ab28188e2a72883989b108b4e36a8cac02da9f4112497f817bd98606816d827bd7
SSDEEP 98304:YzroElDFDyyHHQjnC3+xd+z2GcJciWCLT8TgeGbg5kAgCgHYyARvgbi0QNSLQb:y1DFDyadAJciWCLBe22kApgHdFQALQ
TLSH
T1C817BE03FB425ADCD03AD57042A5B363B3617808873456EB17C2AE285E67FD05E7BB89
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24426

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Downloads\sigmaboytool\eacemu\bin\x64\Release\Kryptonite-Nebulizer.next.pdb

kernel32

GetProcAddress GetModuleFileNameW VirtualFreeEx VirtualQueryEx VirtualAllocEx VirtualProtect VirtualAlloc Sleep SetLastError GetLastError CloseHandle GetTempPathW SetFilePointerEx SetFileInformationByHandle SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose MoveFileW MoveFileExW FindFirstFileA FindNextFileA HeapAlloc LocalFree GetProcessHeap FreeLibrary GetModuleHandleA FileTimeToLocalFileTime GetFullPathNameW DuplicateHandle CopyFileExW HeapReAlloc SetHandleInformation UnlockFile FlushFileBuffers SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx DeleteFileW FindFirstFileExW GetFinalPathNameByHandleW CreateSymbolicLinkW GetModuleHandleExW GetFileType GlobalLock GlobalAlloc GlobalUnlock LoadLibraryExW GlobalSize GlobalFree SetThreadErrorMode SetEndOfFile HeapSize HeapFree CopyFileW K32GetDeviceDriverBaseNameA K32EnumDeviceDrivers lstrcpynA

gdi32

CreateBitmap SetBrushOrgEx SetBitmapBits CreateDIBSection SetStretchBltMode StretchBlt SelectObject GetDIBits GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateRectRgn BitBlt GetObjectW CreateCompatibleBitmap CreateDIBitmap ChoosePixelFormat SetPixelFormat SwapBuffers DescribePixelFormat

user32

SetClipboardData EmptyClipboard EnumClipboardFormats ValidateRect CountClipboardFormats CloseClipboard EnumDisplayMonitors MonitorFromPoint GetDC OpenClipboard MonitorFromRect ScreenToClient IsClipboardFormatAvailable MonitorFromWindow GetMonitorInfoW RedrawWindow ClientToScreen ChangeDisplaySettingsExW InvalidateRgn ReleaseDC GetClipboardFormatNameW RegisterClipboardFormatW GetClipboardData AdjustWindowRectEx GetWindowLongW SetWindowLongW SetWindowTextW GetWindowTextLengthW SendInput MapVirtualKeyW TrackPopupMenu SetMenuDefaultItem EnableMenuItem GetSystemMenu CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture SetWindowLongPtrW GetMenu ReleaseCapture GetCursorPos CreateIconFromResourceEx GetWindowLongPtrW GetForegroundWindow SetCursorPos GetActiveWindow FlashWindowEx SetWindowPlacement GetWindowPlacement PeekMessageW SetCursor LoadCursorW PostMessageW GetClientRect GetWindowRect IsWindowVisible GetWindowThreadProcessId CreateIconIndirect DestroyIcon SendMessageW EnumWindows ToUnicodeEx MessageBoxA GetKeyboardLayout MapVirtualKeyExW GetKeyboardState CreateIcon GetWindowTextW SetForegroundWindow GetSystemMetrics KillTimer SetTimer SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW wsprintfA LoadImageW GetRawInputDeviceInfoW RegisterRawInputDevices SystemParametersInfoA ToUnicode SetWindowDisplayAffinity RegisterWindowMessageA DestroyCursor GetKeyState RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware MsgWaitForMultipleObjectsEx GetRawInputData IsIconic SetPropW GetPropW CallWindowProcW RemovePropW GetClassNameW GetClassInfoExW GetClipCursor FindWindowW ShowCursor ClipCursor

api-ms-win-core-synch-l1-2-0

WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtCreateFile NtOpenFile NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtSetInformationFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError RtlUnwind RtlUnwindEx RtlPcToFileHeader

userenv

GetUserProfileDirectoryW

bcryptprimitives

ProcessPrng

ole32

CoCreateGuid CreateStreamOnHGlobal PropVariantClear PropVariantCopy RevokeDragDrop CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop CoCreateInstance

shell32

DragQueryFileW DragFinish ShellExecuteW ShellExecuteExW ShellExecuteA

shlwapi

AssocQueryStringW

api-ms-win-core-path-l1-1-0

PathCchStripPrefix

oleaut32

SysFreeString SysStringLen SysAllocStringLen SafeArrayCreateVector SafeArrayPutElement SetErrorInfo GetErrorInfo VariantClear VariantCopy

winhttp

WinHttpReadData WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetTimeouts

ws2_32

listen bind getsockname WSADuplicateSocketW accept WSASocketW sendto freeaddrinfo GetHostNameW WSAStartup WSACleanup WSCUnInstallNameSpace closesocket getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket recv shutdown send getpeername WSARecv WSASend connect select recvfrom

advapi32

LookupPrivilegeValueW RevertToSelf ImpersonateAnonymousToken StartServiceW CreateServiceW ControlService RegDeleteValueW ConvertSidToStringSidA QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegEnumValueW RegCloseKey GetUserNameW OpenProcessToken AdjustTokenPrivileges SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation

bcrypt

BCryptDeriveKey BCryptDecrypt BCryptSetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptFinishHash BCryptGenerateSymmetricKey BCryptDestroyHash BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroySecret BCryptGenerateKeyPair BCryptSecretAgreement BCryptEncrypt BCryptExportKey

setupapi

SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiCreateDeviceInfoW SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoList

cabinet

ord45 ord40 ord43

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetCommandLineA SetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentVariableA GetCommandLineW GetStdHandle GetEnvironmentStringsW GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

ReadFileEx WriteFile ReadFile CreateFileW WriteFileEx LockFileEx CreateDirectoryW CreateFileA CreateDirectoryA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe CreatePipe PeekNamedPipe CreateNamedPipeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult CancelIoEx DeviceIoControl

api-ms-win-core-synch-l1-1-0

CreateMutexW WaitForSingleObject AcquireSRWLockExclusive SetWaitableTimer ReleaseMutex ResetEvent CreateWaitableTimerExW TryAcquireSRWLockExclusive CreateMutexA WaitForSingleObjectEx EnterCriticalSection SleepEx LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive CreateEventW SetEvent

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW SetThreadStackGuarantee InitializeProcThreadAttributeList GetProcessId GetCurrentProcess GetCurrentProcessId TerminateProcess ExitThread GetExitCodeProcess SwitchToThread OpenThread ResumeThread ExitProcess CreateThread CreateRemoteThread GetExitCodeThread GetCurrentThreadId DeleteProcThreadAttributeList UpdateProcThreadAttribute CreateProcessW GetCurrentThread

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemInfo GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetSystemTimeAsFileTime GetLogicalProcessorInformationEx

api-ms-win-core-memory-l1-1-0

WriteProcessMemory ReadProcessMemory

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread LoadResource LoadLibraryExA LockResource SizeofResource GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW LoadLibraryA

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW lstrlenW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW CompareStringOrdinal CompareStringW

api-ms-win-core-console-l1-1-0

AllocConsole SetConsoleCtrlHandler GetConsoleMode GetConsoleOutputCP ReadConsoleW WriteConsoleA WriteConsoleW SetConsoleMode

api-ms-win-core-console-l1-2-0

AttachConsole FreeConsole

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-toolhelp-l1-1-0

Thread32Next Thread32First Process32FirstW CreateToolhelp32Snapshot Process32NextW

crypt32

CryptStringToBinaryA CryptUnprotectData CryptBinaryToStringA CryptProtectData

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-file-l2-1-0

CreateHardLinkW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsGetValue FlsAlloc FlsFree

api-ms-win-core-fibers-l1-1-1

IsThreadAFiber

api-ms-win-core-localization-l1-2-0

GetCPInfo GetOEMCP FormatMessageA GetACP GetLocaleInfoEx FormatMessageW IsValidCodePage LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

ext-ms-win-uiacore-l1-1-1

UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent

ext-ms-win-uiacore-l1-1-0

UiaHostProviderFromHwnd UiaReturnRawElementProvider

propsys

VariantToUInt32 PropVariantToBSTR VariantToPropVariant PropVariantCompareEx PropVariantToVariant PropVariantToBoolean VariantToBoolean PropVariantToInt64 VariantToDouble PropVariantToDouble VariantToInt64 PropVariantToUInt16 VariantToInt16 PropVariantToInt16 VariantToUInt16 PropVariantToUInt32 VariantToInt32 PropVariantToInt32 VariantToUInt64 PropVariantToUInt64

opengl32

wglDeleteContext wglMakeCurrent wglGetProcAddress wglGetCurrentDC wglGetCurrentContext wglShareLists wglCreateContext

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

imm32

ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmGetCompositionStringW

uiautomationcore

UiaLookupId

gdiplus

GdiplusShutdown GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipCloneBrush GdipDeleteBrush GdipSetStringFormatLineAlign GdipNewPrivateFontCollection GdipCreateFont GdipGetGenericFontFamilySansSerif GdipCloneFontFamily GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGetImageEncoders GdipGetImageEncodersSize GdipFillPath GdipSetStringFormatAlign GdipFillEllipse GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipDrawString GdipGraphicsClear GdipDrawPath GdipSetTextRenderingHint GdiplusStartup GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipSaveImageToStream GdipDisposeImage GdipGetFontCollectionFamilyCount GdipCloneImage GdipDeletePen GdipCreatePen1 GdipPrivateAddMemoryFont GdipGetFontCollectionFamilyList GdipCreateSolidFill GdipDeleteFont GdipFree GdipAlloc GdipDeletePrivateFontCollection

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

Name

.text

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

645KB

Virtual Size

645KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Kainite Emulator.exe

kernel32

gdi32

user32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

bcryptprimitives

ole32

shell32

shlwapi

api-ms-win-core-path-l1-1-0

oleaut32

winhttp

ws2_32

advapi32

bcrypt

setupapi

cabinet

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-toolhelp-l1-1-0

crypt32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-1

ext-ms-win-uiacore-l1-1-1

ext-ms-win-uiacore-l1-1-0

propsys

opengl32

dwmapi

uxtheme

imm32

uiautomationcore

gdiplus

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-datetime-l1-1-0

generic