J��b���� lf�@&R��:�U W��ETb�����_%Y�Y����Dx5w������������m��Oʼ.�@z�;���6��e��f�Y�}�������F[���<"��K��U�7� ��U����+�l�Qý�,@,e�Y��}P��|9A3��Ss(��*`Ô�W���&�?f�ڶ��]e���u?�٪WeK����O(��#�|�e�3���*�w��R�k}�Ģ��qIr"���7:� ��]�����Z�.�t�O\�reTZW���E�e���+-���$w��J�7��O4B��CO�É�n���qE_j.�Q��!FD贯��rL����3� �+�.^�=dF �����k9cO�%`��\��D�U�a���:�@QOMyY�jY�ޟ�(Z������ܪ��,�\(�5F�S s��*X֙h��u.�Uq��ԫ�>�sP1!�"��u�i-פ�����;k5�����6��?�v�H�z���OP����~���Ԯ �̥���&|ÅK�Sӯ&|�[X#R� ���C*9���ޮUK�m�T��x�L����k(q� )�9�GߣX�/ea>��ױ&e��4�:�tIn(�#��>2+�F>g���U�@�nLcn�t2���gJr�R$(���A �����'3I�7�RS.[b��3LI6�>[���u����5����σ�X�DR;U�v�����sә7̜�B29X�<��?�ζu�}���[���q��Ε�p��v������y��S��.�0����F��:"�$�Q��]D��Ȼ���_Mh�ŵ0������jo�U̐&��R��)�����'�\G��"X��tʷ�/��@:��6�� מb�--��S������k��n;��e 7��e*. �N��E~� a��$���uj��c�l{L�:��LR�Z�Љ,x�����%x�z�8����UF�� ���ب[�ߐ�ԞքH�04��]4�r���JC�6ۛ���\�X�K����������+��gR8�����Ђ��S��I4ߥ���U� �R/�X��!�u#�\��_R��vA1�P���&"��E�k92������.E�ӧ��g�?��w����w�!?V%B�Ox����|r��'�-&���,^���t*f�pR��kgY�5?K�ó9.n��a9V'ETM �#�wCp��c�:�.�y�;�F�2�V������=����ռ �,�<�t�U������3Fsqx���4�w�:1PG�>����Ǡ��A�}���d� ��xo�|������!��/mao�\��T.�eA�Ru�Q�+���'9�� �����f�B!L�L����}��ML����p����8q���$F�O�tJW�$�$Vl��|'���Z�s�i[��62p}�E��D&��H�QB������E d'7�fڏ���1�������8�ƫ���L��M��$.8�p���O��>9k�C$�!��S�A ���IN�O�>d��Dcmzd/��"Si�t� ��20y]s9)�HV�>�):��L�����l��p�C��i�5=8H�wr�fWe�?�8l�����5���lv�z#�[a��-hQ/�����O����f����m/ �Ãf$�l4�ӝ�>���c>Bl�/�����.�=Φ���PB�ϻ���'ek$���(b�� A��y�"�7�`W�y1��, +��e������W�(?�}�O3J���4�ȭ�������LÈ��pP^f�E*t�=��6\�cz��'WƝaOV�rWg��1�j-�l�`X�e��Ow�8:�g�������) w��uDeh6�O1�䳳ג�Ȫ�W��E��o���*��Q�+U��`���gZ�I��H�HA�Hv�A��e���$-q!^��Y+��hie����axYZ�bE, 0c�� y[D$,km���W������2��B,KvQ�M��%,=�v��K+������d8�q!(�.�9��ⱎhd����� ό;��iI��[p"��s�1?�|�7J+P����h��`^��Qa������O��/���1Fmd���0)�� ���0Q��xؙ�z�ڔ�$�N��d���Ls����f�% ��ru�pp;�����K^����p�����p8�Z>�[3�n�H�+����[sE��Y�у�z_ ;3�f��7m�V��6� �_)���4pm��I�ƻ)z�#�m�Q:�Y�W��<'{��h�RV.����y�,$hC��C4v��l���DF&"���L�=B�W�uc���6E��N�5�W��^�Fc.o��"��"P�_�s���@��9*~�n9��V���������34-%g��s�ʝƎ�:��2DJ��:��F3��O�h�A�rU��q3��<b�y��V'4�H��i�+���;Qh�<���ue���c��S��Ĥ]�����$7z6���C��M����B6)�ƪ���s�9�n%[}��$���zXת�[��J�h�K�ݯ�T�^0� g^���� ���h6�&�Nw��-!���U�[�]�MF MR.��9et��@%Y1/�i����e�X�:p�䜦u�����EU��w)���h�r�D/Xר|Zi��ǻ|4y���������m&�y��k���6z�=�,\3ĬDe����w�l�d�g�"�O���ݤtQtG�o�b�0C�$�a����٣o���%|TY&�Չg͙nv��!*Ck��2�����2�5F��GfМ��{�!Bfi�($k��C�����-�����4�^�b0GN d����A�{��-��c�b�~�ǽ�ޑ�fhX�!�<#���+����0�.�{�y���O��Q^GF��C�'!��G�]����Y͞3�ܕ�Ȯ��A�E�����1s(��kt���3���TUV�^�H&��6� �-� ��@��Ϣ���9m��K� �T[��n|�zM����Rѹ�߈�vy�M��R0壛z��.�I��`V.�H������U_҄ʭ��O0�xbX����!�d�g6�fg����V)��KL K�r
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
client.exe
Resource
win10v2004-20221111-en
General
-
Target
client.exe
-
Size
14.8MB
-
MD5
4cebfa617697b1ae34c67627063b5ed0
-
SHA1
ff8c60781416f213288f2d5a264480423ec2aedf
-
SHA256
4201337f80121e9f6fc98190375c0b82af37e8971847e5e5211df1fa90b33610
-
SHA512
eafde1312382d2c22c5718066ef09bbd019d5d76fb4c6522a00bb26ae3f02eb02c8a32a476dec690a295063d76eaa23a887762597160c9286b8132ba2f49fbfa
-
SSDEEP
393216:xTggCfTqP5Jy/NhSH3v4tF4qHWMDaY+x/9K72:uDMJoSHc4ea/FK7
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
client.exe.exe windows x64
5ccb84711923e8fdc12f1da5f386f241
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
htonl
d3d9
Direct3DCreate9
kernel32
GetOEMCP
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
CharUpperBuffW
advapi32
CheckTokenMembership
shell32
ShellExecuteA
version
VerQueryValueW
imm32
ImmReleaseContext
xinput1_3
ord2
Exports
Exports
Sections
.text Size: - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ