0xdeadbeefnetwork-KKYUMPoC/ANALYSIS.md

# KKYUM.sys Driver Analysis Report

## Executive Summary

KKYUM.sys is a Windows x64 kernel driver (26,768 bytes) that appears to be designed for process memory manipulation and interaction with the Windows input subsystem (mouse/keyboard drivers) and GUI components (win32k).

**SHA256:** `72BD55F4459C992B9CAA1A33CB6862F1F3085CA35839C58DEE8B75DB22CA605F`

## File Metadata
- **Architecture:** x86-64 (x86:LE:64:default)
- **Platform:** Windows
- **Type:** Kernel Driver (.sys)
- **Size:** 26,768 bytes
- **Framework:** Windows Driver Framework (WDF/KMDF)

## Memory Layout

```
Section          Start Address  Size    Permissions
-------          -------------  ----    -----------
Headers          0x140000000    0x400   R--
.text            0x140001000    0x2600  R-X  (executable code)
.rdata           0x140004000    0xc00   R--  (read-only data)
.data            0x140005000    0x4e0   RW-  (writable data)
.pdata           0x140006000    0x200   R--  (exception handling)
INIT             0x140007000    0x600   R-X  (initialization code)
.reloc           0x140008000    0x200   R--  (relocations)
tdb              0xff00000000  0x1850  RW-  (type database)
```

## Key Findings

### 1. Device Interface
The driver creates a device object and symbolic link for usermode communication:
- **Device:** `\Device\KKYUM`
- **Symbolic Link:** `\DosDevices\KKYUM`

This allows usermode applications to open a handle to the driver and send I/O control codes (IOCTLs).

### 2. Process Memory Manipulation Capabilities

The driver imports critical functions for reading/writing process memory:

- **`MmCopyVirtualMemory`** - Copies memory between process address spaces (referenced 3 times)
  - This is a powerful kernel function that allows reading/writing to any process
  - Commonly used by game cheats and malware for process injection

- **`PsLookupProcessByProcessId`** - Locates process structure by PID
- **`KeStackAttachProcess`** / **`KeUnstackDetachProcess`** - Attaches to target process context
- **`IoGetCurrentProcess`** - Gets current process
- **`PsGetProcessWow64Process`** - Gets WOW64 information (32-bit on 64-bit)

### 3. Input Subsystem Targeting

String references indicate targeting of mouse and keyboard drivers:

```
\Driver\mouclass    - Mouse class driver
\Driver\kbdclass    - Keyboard class driver  
\Driver\kbdhid      - Keyboard HID driver
\Driver\mouhid      - Mouse HID driver
\Driver\i8042prt    - PS/2 keyboard/mouse port driver
```

This suggests potential capabilities for:
- Input injection (sending fake mouse/keyboard inputs)
- Input filtering/monitoring (reading user inputs)
- Bypassing user-mode input validation

### 4. Windows GUI Subsystem Access

References to win32k components:
- `win32kbase.sys` - Windows kernel-mode base subsystem
- `win32kfull.sys` - Windows kernel-mode full subsystem  
- `ValidateHwnd` - Function for validating window handles

This could indicate:
- Direct manipulation of GUI elements
- Bypassing user-mode window message queues
- Window handle validation/enumeration

### 5. Process Targeting

- **`winlogon.exe`** - Windows logon process
  - This is a critical Windows process that handles login/logout
  - Targeting it could indicate credential harvesting or session manipulation

### 6. System Information Queries

- **`ZwQuerySystemInformation`** - Queried twice
  - Can retrieve system-level information
  - Often used for anti-detection or process enumeration

### 7. Dynamic Function Resolution

- **`RtlFindExportedRoutineByName`** - Finds kernel functions by name
  - Allows runtime resolution of undocumented kernel functions
  - Common technique to avoid static analysis detection

## Security Implications

### Potential Malicious Uses:
1. **Game Cheating/Anti-Cheat Bypass**
   - Read/write game process memory
   - Inject fake input events
   - Bypass anti-cheat detection

2. **Keylogging/Input Interception**
   - Monitor keyboard/mouse inputs at kernel level
   - Bypass user-mode security software

3. **Process Injection**
   - Inject code into arbitrary processes
   - Escalate privileges
   - Hide malicious activity

4. **Credential Harvesting**
   - Target winlogon.exe for credentials
   - Read password memory from processes

5. **Rootkit Capabilities**
   - Kernel-level code execution
   - Hide processes/files/network connections
   - Disable security software

## Function Analysis

- **Total Functions:** 90
- **Entry Point:** `0x1400029e0`
- **Notable Imports:**
  - Memory management: `ExAllocatePool`, `ExFreePoolWithTag`, `MmMapLockedPagesSpecifyCache`
  - Device management: `IoCreateDevice`, `IoDeleteDevice`, `IoCreateSymbolicLink`
  - Process operations: `MmCopyVirtualMemory`, `KeStackAttachProcess`
  - Object management: `ObReferenceObjectByName`, `ObfDereferenceObject`

## KMDF Framework

The driver uses the Kernel-Mode Driver Framework (KMDF):
- `WdfVersionBind` - Binds to WDF runtime
- `WdfLdrQueryInterface` - Queries WDF loader
- `WdfVersionBindClass` - Binds to WDF class

This provides a structured framework for driver development but also indicates a relatively modern/well-structured implementation.

## Static Analysis Pattern

Found binary pattern (likely signature for code searching):
```
E8 ? ? ? ? 8B ? 85 C0 75 0E
```
This appears to be a pattern for locating specific code sequences, possibly for hooking or patching.

## Recommendations

### For Security Researchers:
1. **Dynamic Analysis:** Run in isolated VM with process/registry monitoring
2. **IOCTL Analysis:** Reverse engineer IOCTL handlers to understand full capabilities
3. **Decompile Entry Point:** Examine `DriverEntry` and IRP handlers
4. **Memory Analysis:** Monitor `MmCopyVirtualMemory` calls to see what it's reading/writing
5. **Input Monitoring:** Check if it hooks keyboard/mouse driver chains

### For System Administrators:
1. **This driver should be treated as potentially malicious**
2. **Do NOT load on production systems**
3. **Check for persistence:** Registry `SYSTEM\CurrentControlSet\Services\KKYUM`
4. **Monitor for:** Unsigned driver loading attempts
5. **Detection:** SHA256 hash can be used in EDR/AV signatures

## IOC (Indicators of Compromise)

- **File Hash:** `72BD55F4459C992B9CAA1A33CB6862F1F3085CA35839C58DEE8B75DB22CA605F`
- **Device Name:** `\Device\KKYUM`
- **Symbolic Link:** `\DosDevices\KKYUM`
- **Service Name:** Likely "KKYUM" (typical convention)

## Next Steps for Analysis

1. **Decompile DriverEntry** - Understand initialization and IOCTL registration
2. **Analyze IRP Handlers** - Reverse engineer DeviceIoControl handlers
3. **Trace Memory Operations** - Dynamic analysis of MmCopyVirtualMemory usage
4. **IOCTL Fuzzing** - Test driver stability and find vulnerabilities
5. **Signature Creation** - Create YARA rule for detection
6. **Behavioral Analysis** - Run in VM and monitor kernel API calls

## Conclusion

KKYUM.sys is a kernel driver with capabilities for:
- ✅ Process memory reading/writing (via `MmCopyVirtualMemory`)
- ✅ Input system manipulation (mouse/keyboard driver references)
- ✅ GUI subsystem interaction (win32k references)
- ✅ Process targeting (winlogon.exe)
- ✅ Dynamic function resolution (anti-analysis)

**Risk Level:** HIGH - This driver has all the capabilities needed for malicious activities including game cheating, keylogging, process injection, and rootkit functionality.

**Recommendation:** Treat as malicious until proven otherwise. Do not load on any system with valuable data.