�-�xdr���[O�\��TOIrm�]ht�L�s�}f���ⓣ�"l)qn6�y��:�<�HM{oȈ������KHV�����H����!�=ȧ����)@���4�P��H���y������q.~v&��&��}N����!Z?8S�&�����D�DH@�ҡ&1�|�X�0c4��{.`��ZOrV���-}�n�IȴT�j�Rhn�$��u����+�n��#:,�Za��6:����}���.1�;�ؼ�Z�{.'y����_����SgR���W�|Ư�2(sZ����0SgK#���O6� ��b@�l���P�B6M»it�6NHK�w���l��*^�/�!< ����Z7Y �rHX㋁(iX�/�����n9)]�&*�;�Ie�^�D��G�]��\�t���у��V[��`|;���TWk���1����8G�\֜(�t��EƛHO��A翲$@��Z9������GDmc��n3�E��ۗ���� ��2���`� Z-?w+�|υvE'�j��t�-�B�W�q=����Ub{Q�%� �;�z�`�8I�6Ú�2�u�J��lw�Q�ۧ�''�>��2��=�L���y�I�i�$��2>�|M��x�q�q �p�4վ������O�� �y�k��k����#a��j�73�/(a߫V4�� 4���KoC���r���h�� o�_{�mn���+���%g�E���e�.@)&�7t� ) J�d�"�3�4�\���֓�\�r�3�cX��� ��C= ���u�J=��wa�Q`�I'�p�����2��W�|�%�uy�7��5�� `��r`�ҲzP�<s�������R���8�Ua��ʺ���@���M���͎�b��*�U�u4ٳ>-���8Qx���p>u�b?���p��WLK#@�_�׀��k������U#<��n�������Ĵl(-�� LW��&�)oplG�X�ew*i=�����t�ch�P��Lp;��Α�S`��ư�@����uE�Wc�D��ef)�����Sr �� ��x�6n,ԚY*�)w�=͍�@zNC�+*r����~-��Hk �+B���`j� �����Q�S��i���E�.n]�mSI�A��IZfª���:�~1���prHG]l�D���QL���ҏ��� vS+��NFfR-r�w���)����w� �57F��ĤZ-DSݼ}��D�N�đ!�J��-;tKtv%5���rk��Cm�A�M0���wj��j� �������+7�Tߤ���A�d�Z1���s�VG�+�A�i�_4�9��`�����-���� �N��������6���W-)Z7q?R�E������,�%�)�=�j����Ӑ���q3`y���9�7���ls���*W�O<�os��q��;� ��0����c۾��Ӏ{�ޱ���������6�?V~���Y��aX,�@ؔR �d�������a��+����O7"��;�b���QX����P������V̸I '��J���iW��]�2�mo_��� ��Y�#\8*=|k@ה��]& �̒"�0��;�2�U��u�aġ�c���E3|�6��,�q���]���K�; J�,���~�RS!��������}s�K���w���N�rX �*�-��R�f���o��Oy�{@�3�9��Ht��^�<�N>0�}���sfCw{?#G���p���� .���*-�1a줯t(6S��2ۓ�aah�851 S[@�����,��� ��V��H �T5�5M$ju֩�յ1�u�ڢ��yp�%P�/v���1����GI�~�xfn�ʗ^����8~^g��Bp�s��og���R2�*�W�1r�����57 ���8g��������l��{J��hPF�gɊꚱߌr��G��Y'��$�=48:����p�~P�~�8Du*��eA�Dh[,��q�����-/ց#9���a@ݼ�����Wmi�0���*���G��l-� �w�PIٶd�=ct��w���:�f�!�}�gI��;�12g�9z��Btr��Q�3� ��W���Un=� ��\�|2�G-��o�S�1�5,ў5�ͪ�p$~��8���$�����M���^Ƽ�q��`̟ZP�q�_��)��Ka-O�י$%�U[_��P��ư���UOz�tzG⋦��d[�`wY�^���JTm��SА��[f��h�8��Zw����%��tE����=�}קjck��Z�����BC��>�Gm]f��OC�^E���a�J3�F���x����nb�����S��D�&H��=�G�� 57�:d�KXCPr؏1�ޠ";䓩^��f��S*�����rTς�sE��wY�4'A=��+o'PKڊ�b]H�.u��9��3��������M�?1]��*�����L��ڜ.0'�hp�Ea+�11�|�ϵ�;x��;���N��V����E�͡�m6��'�&���L�7ə��T,����[��ݴ��%�"�/[�w�@I�h���ٲ �o�*z���y��&���A���^�R�.t Nj��G0oG�hP����������)��f8a�wDK2��PW9��A�����*�aŋ����#�}fw�Wq��$E�H����g�bN�[.�:��]�Өd��%<�֪*1g9Fp݁颡�5fU?�H a�� -���4I��M�5��JIO�e�\ۓ�d F*�@���Es(�1�� ��L�q��d��~m����2,�;䯣H;�;.��i����Sg�a��ji�=M/�%`$����F��v͚֬�^�����Y�����MRV5;*m���0~��dY��s݂K�e��q%�3fK3�����C\�Q�Po-h��u>��qB+Đc���\���������槟a@n��%gJ\"��]4;�G�����ϛ`(���2�W1Y�+*J��[��N���^�5*8��6�t:z��$�6W P�Rh+���H��?~֨й ������<%����,O�G3�'���Mt���]}���t��?@��V��k�?{��mg�o�~Vꚸ0��#���)v���[�]�
Behavioral task
behavioral1
Sample
EFT Cronos.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
EFT Cronos.exe
Resource
win10v2004-20220812-en
General
-
Target
EFT Cronos.exe
-
Size
16.7MB
-
MD5
3b25481f6a0b6aa2674f1c2716db9862
-
SHA1
e2ed1463cda072cc76e619b93a51ad5e6d532913
-
SHA256
805e41f6e414f3292a1a35731558af0ecfecc07e76c7394c7f162e1f56eef0cf
-
SHA512
dac29f7c8500c120bffce2b44c30e5fa44cbc5c9ff67aae6f0e4561e43814e7696c0f9a23a2ae07a83a3de63a9ac0549b7a213e40a74d8a255fd673a9ccb1ceb
-
SSDEEP
393216:/XKmM6/AMgZDmkApzBaLPEjhOB1ngMsT5/wVtD89XXR+YT7:RAMgZ6jaLPEUHgXTWtD8fdX
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
EFT Cronos.exe.exe windows x64
d6d4b764a10dee1bd833642c41869036
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHDeleteKeyA
urlmon
URLDownloadToFileA
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
DeviceIoControl
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
advapi32
CryptDestroyKey
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantInit
d3dcompiler_43
D3DCompile
imm32
ImmSetCandidateWindow
ws2_32
WSASetLastError
crypt32
CertGetCertificateContextProperty
msvcp140
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
ntdll
RtlFreeAnsiString
wtsapi32
WTSSendMessageA
WTSSendMessageW
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
fgets
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 933KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 16.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 16.7MB - Virtual size: 16.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ