CrypKey V56X DLL Kenonic Controls Ltd additional

Hunt Hypothesis

This rule detects the presence of a specific CrypKey V56X DLL associated with Kenonic Controls Ltd, indicating potential use of a known cryptocurrency miner or trojanized component within the environment. Proactively hunting for this artifact allows the SOC to identify low-severity persistence or resource-exhaustion mechanisms that may be overlooked by standard alerts, ensuring timely remediation of embedded malicious code in Azure Sentinel.

YARA Rule

rule CrypKey_V56X_DLL_Kenonic_Controls_Ltd_additional: PEiD
{
    strings:
        $a = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Application Deployment via MSI/EXE Installers: Many enterprise applications (e.g., Adobe Creative Cloud, Microsoft Office, or specific Kenonic ControlCenter clients) bundle the CrypKey or similar cryptographic DLLs within their installer packages. When the installer extracts files to the temp directory (%TEMP%) or the application’s install directory, the YARA rule may match the DLL if it is scanned in a non-standard location or if the signature overlaps with the “additional” variant.

  • Filter/Exclusion: Exclude file paths matching C:\Program Files\* or C:\Program Files (x86)\* where the parent process is a known installer (e.g., msiexec.exe, setup.exe, installer.exe). Alternatively, exclude if the file hash is known to be part of a signed, trusted application bundle.

• Scheduled Maintenance Jobs for Kenonic ControlCenter: In environments using Kenonic ControlCenter for ETL or data integration, scheduled tasks (e.g., via Windows Task Scheduler or cron-like equivalents) may launch the ControlCenter client or agent, which loads the CrypKey DLL for license verification or secure communication. If the YARA rule triggers on the DLL being loaded by a service or scheduled task process, it may be flagged as anomalous if the rule expects a user-interactive context.

  • Filter/Exclusion: Exclude if the parent process is svchost.exe (specifically for Kenonic-related services) or TaskScheduler.exe, and the file path resides in the Kenonic installation directory (e.g., C:\Kenonic\*). Verify that the DLL is signed by Kenonic Controls Ltd.

• Antivirus/EDR Real-Time Scanning Artifacts: Some EDR or AV solutions create temporary copies of scanned files in their quarantine or staging directories (e.g., `%Program