Windows Analysis Report
KrMhCpCNtm.exe

ID:	1545844
Product:	CloudBasic
Start time:	06:49:08
Start date:	31.10.2024
Sample:	KrMhCpCNtm.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	18fb86e828354d879698e7fefdde11a0
SHA1:	3242e65c4c9a45a57aea38bd6bfdbe990a5c543f
SHA256:	0e053da640e325971896b97f0993fbb17dd010bdc9625ca6fa4ee64c4a5f018a
Filetype:	Win64 Executable Console (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
\Device\ConDrv	ASCII text, with CRLF, CR line terminators	293C14E3E6CE8BCF759BCB6365C0D4FB	0D7B836D72608CD666F00FFFAC677B8BFB660161	3C5C212D5DC08B830238A0B4B2B46B07EEA0847F1C05CC658F27F4DC44BE384C

AV Detection

Source: KrMhCpCNtm.exe

Avira: detected

Source: KrMhCpCNtm.exe

ReversingLabs: Detection: 60%

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.8% probability

Source: KrMhCpCNtm.exe

Joe Sandbox ML: detected

Compliance

Source: KrMhCpCNtm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\userX\Desktop\kdmapper-master\x64\Release\kdmapper_Release.pdb source: KrMhCpCNtm.exe
Source:	Binary string: C:\Users\userX\Desktop\kdmapper-master\x64\Release\kdmapper_Release.pdb11 source: KrMhCpCNtm.exe
Source:	Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: KrMhCpCNtm.exe

Networking

Source: KrMhCpCNtm.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: KrMhCpCNtm.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: KrMhCpCNtm.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: KrMhCpCNtm.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: KrMhCpCNtm.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07

System Summary

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF6673632E0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,VirtualFree,		0_2_00007FF6673632E0
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF66736F220 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,VirtualFree,_stricmp,VirtualFree,VirtualFree,_invalid_parameter_noinfo_noreturn,		0_2_00007FF66736F220

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF667362880: DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,DeviceIoControl,DeviceIoControl,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,

0_2_00007FF667362880

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF667361CE0		0_2_00007FF667361CE0
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF667361760		0_2_00007FF667361760
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF66736B770		0_2_00007FF66736B770
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF6673632E0		0_2_00007FF6673632E0

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: String function: 00007FF667366260 appears 105 times

Source: KrMhCpCNtm.exe, 00000000.00000000.1671593345.00007FF667372000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiQVW64.SYSH vs KrMhCpCNtm.exe
Source: KrMhCpCNtm.exe, 00000000.00000002.1672823126.00007FF667372000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiQVW64.SYSH vs KrMhCpCNtm.exe
Source: KrMhCpCNtm.exe	Binary or memory string: OriginalFilenameiQVW64.SYSH vs KrMhCpCNtm.exe

Source: KrMhCpCNtm.exe

Binary string: Unknown exceptionbad array new lengthstring too longbad cast\\\.\Nal[-] \Device\Nal is already in use.[<] Loading vulnerable driver, Name: [-] Can't find TEMP folder[-] Failed to create vulnerable driver file[-] Failed to register and start service for the vulnerable driver[-] Failed to load driver iqvw64e.sysntoskrnl.exe[-] Failed to get ntoskrnl.exe[-] Can't exploit intel driver, is there any antivirus or anticheat running?[-] Failed to ClearPiDDBCacheTable[-] Failed to ClearKernelHashBucketList[!] Failed to ClearMmUnloadedDrivers[!] Failed to ClearWdFilterDriverListWdFilter.sys[+] WdFilter.sys not loaded, clear skippedxxx????xxH

Source: KrMhCpCNtm.exe

Binary string: \Device\Nal

Source: classification engine

Classification label: mal64.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF66736A700 GetCurrentProcessId,CreateToolhelp32Snapshot,memset,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF66736A700

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03

Source: KrMhCpCNtm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KrMhCpCNtm.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\KrMhCpCNtm.exe "C:\Users\user\Desktop\KrMhCpCNtm.exe"
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: msvcp140.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: vcruntime140_1.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: vcruntime140.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: vcruntime140.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: vcruntime140_1.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: vcruntime140.dll			Jump to behavior
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: KrMhCpCNtm.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KrMhCpCNtm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KrMhCpCNtm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: KrMhCpCNtm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\userX\Desktop\kdmapper-master\x64\Release\kdmapper_Release.pdb source: KrMhCpCNtm.exe
Source:	Binary string: C:\Users\userX\Desktop\kdmapper-master\x64\Release\kdmapper_Release.pdb11 source: KrMhCpCNtm.exe
Source:	Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: KrMhCpCNtm.exe

Source: KrMhCpCNtm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KrMhCpCNtm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KrMhCpCNtm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KrMhCpCNtm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KrMhCpCNtm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF66736A700 GetCurrentProcessId,CreateToolhelp32Snapshot,memset,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF66736A700

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

API coverage: 2.0 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF667370910 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF667370910

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF66736A700 GetCurrentProcessId,CreateToolhelp32Snapshot,memset,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF66736A700

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF66736A870 SetUnhandledExceptionFilter,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,memcpy,memcmp,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memcpy,memcpy,_invalid_parameter_noinfo_noreturn,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		0_2_00007FF66736A870
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF667370910 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF667370910
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF667370120 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF667370120
Source: C:\Users\user\Desktop\KrMhCpCNtm.exe	Code function: 0_2_00007FF667370ABC SetUnhandledExceptionFilter,		0_2_00007FF667370ABC

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\KrMhCpCNtm.exe

Code function: 0_2_00007FF667370B68 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF667370B68