> For the complete documentation index, see [llms.txt](https://mapol.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mapol.gitbook.io/home/blog/malware-analysis/keylogger/kimalogger.md). # KimaLogger In the second quarter of 2025, the AhnLab Security Intelligence Center (ASEC) discovered an operation linked to the well known DPRK state sponsored threat actor group `Kimsuky`, also known as `Velvet Chollima`, which began exploiting the `BlueKeep` and `Microsoft Office Equation Editor` vulnerabilities for initial access. KimaLogger came into play during the final stage of the operation, with the purpose of stealing credentials from the infected machine. I found this sample on: [**MalwareBazaar**](https://bazaar.abuse.ch/sample/3af5c9759d95fd6091e665c03406f275fac26afe70db067a785cdc003389efbd/)

AhnLab - Kimsuky Threat Actor Group’s Exploitation of BlueKeep Vulnerability.

*** ### **Table of Contents** 1. [Sample Overview](#sample-overview) 2. Obfuscated Files or Information: Junk Code Insertion (T1027.016) 3. Obfuscated Files or Information: Dynamic API Resolution (T1027.007) 4. Execution Guardrails (T1480) 5. System Time Discovery (T1124) 6. Data Staged: Local Data Staging (T1074.001) 7. Clipboard Data (T1115) 8. Application Window Discovery (T1010) 9. Input Capture: Keylogging (T1056.001) 10. Encrypted Channel: Symmetric Cryptography (T1573.001) 11. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003) 12. Execution Flow 13. Conclusion 14. IOCs 15. Config Extractor 16. YARA Rule 17. Sigma Rule 18. Additional Resources *** ### **Sample Overview** The sample was written in C++ using Microsoft Visual Studio 2012 as the IDE, and it was compiled around September 20, 2024.

Figure 1. Identified the compile time and languages used by the sample.

The overall entropy values show that the given sample does not implement any packing methods. However, an obfuscation technique may be implemented within the code.

Figure 3. The overall entropy values show that the given sample is not packed.

However, the `.rsrc` section of the sample contains the interesting strings `KLogExe` and `KLOGEXE` within the string table, if applying common sense, this could be indicate to the word `Keylog`.

Figure 3. Resource strings related to the keyword keylogger.

*** ### Obfuscated Files or Information: Junk Code Insertion **(**T1027.016**)** In the `WinMain` function, two `LoadStringW` functions are called to load string resources, where the IDs are different, `103` and `109`. This show that the original code itself may implement an `.rc` file for string resource management.

Figure 4. Loading a specific string from the resource section.

As shown in Figure 5, the strings loaded are `KLogExe` and `KLOGEXE`. As seen in Figure 3 from the [**Sample Overview**](#sample-overview), the loaded IDs are directly related to these words.

Figure 5. Loaded strings identified as KLOGEXE and KLogExe.

After the resource strings are loaded, the `sub_140002A70` function is called. Inside this function, a `WNDCLASSEXW` structure is initialized, the cursor is set to a standard cursor, and the icon is loaded from the `.rsrc` section of the sample. The function then returns the result of `RegisterClassExW` to register the window class for the GUI application. However, `CreateWindow`, `CreateWindowEx`, or any other functions used to create a GUI application could not be found. This shows that this code was likely just included as a decoy template.

Figure 6. Initializing structure fields for the GUI application.

*** ### **Obfuscated Files or Information: Dynamic API Resolution (T1027.007)** Now, the thread for the `sub_140001A00` function begins to be created. In doing so, the string `DsfbufUisfbe` is passed as an argument to a function call to `sub_140001000`.

Figure 7. asd

Inside the `sub_140001000` function, an array offset at `off_1400193E` is initialized. Also, each value in the array follows the same scrambled pattern as the argument passed in Figure 7.

Figure 8. asd

Before jumping into the deobfuscation process, the string that was passed as an argument to the `sub_140001000` function is checked against each value in the array. If a match is found, the deobfuscation process is performed.

Figure 9. asd

To deobfuscate these strings, a shift-down caesar cipher algorithm is used. This process can be separated into two parts, one for the DLL name, and another for the function name passed as an argument to the `sub_140001000` function.

Figure 10. asd

After the strings are deobfuscated, they are used as a library to be loaded. It does this by calling the following functions, `LoadLibraryA` and `GetProcAddress`, the same way dynamic API resolution works in various other APT related malware.

Figure 11. asd

*** ### **Execution Guardrails (T1480)** After the thread is created, it checks whether the specified event object, `Norton_BreakHelper613`, already exists using the `OpenEventW` function. If it does, the loop breaks and the newly created thread is deleted, otherwise, the loop continues.

Figure 12. asd

*** ### **System Time Discovery (T1124)** lorem *** ### **Additional Resources**
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://mapol.gitbook.io/home/blog/malware-analysis/keylogger/kimalogger.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.