�Ek4/D8��W� g?i��-�Fa���w[�X��PHӑ:�]�"��H��Vm��p4��`$(���c�5�~�XbR����۳V�C�Y�鸰��'}i�j=�8�g�+i�` �O�l�2�wmi���|ˑ������02��v�;�B� �\;��G��*\0�n�Z���ޟ�!����6��l����'��Z�݉W"��jA�|�����P%�<��B�W0�x�i����j}�+�O�z{J�����}���^��W,HҾ�ٴR����'����z�N�E���.��5��3[��y8L�u��B���Q��A��Lum��I1��{�'�Oޗ��ă.d��a�~ߔ��'*��ޕjA$�(���lR�$��;k��y�~u ���m�3 ��$j��j �~3ݽ#%�q���Ʌ���������Y�++�VCҟ�c�`Z�fẊNi��՚��I���~ϛա\*|.G^�_lZ���`���>���J�=i�r�La�\u_�J݊�Ȁ}ƍ�����v����C������1]�(ov�s�V�� �!Dw%�;�)��M��qoT�h>�b=J��~#��#r��|��D(41s��`%]��R-�Q虰�b��=�̧�WQ�����]��j5�e��p�}_Y� �++��^��x�b-wx%��h7t�}���=���^\�ƴ`���uC>dz�C���`�X<rM����� �������4�}��0,�F�>��c�:5�x}�G��u�}���<���w'��0�R����;�s�,Zƫ�e��h�4t�F#��(�P�ًj��zG�C< ���h3S��8��eӼY����N^���L6�q昪w��tc9T���w.^T#��5P,����B�G"��9W��>�Ѯ�������q�ٻ��v�rL�����b��AG���=&rM(�����3Be������#w��֘����V�R��I݈��7�|I�C)�Ru��E�h��K�ߐ_aοq[�n������:�ڜ!-�+,��� 5XQ��6�=� ���~|o��|gh�g����I�8���w�J�Po�����5|���3��˹_sܪTo�"�cJ[17��D�U�p"kRa�o �-�,m��xY̷ �1�rl4�6�w"5�$Ic�LX�*�{�7T��K,Ӗ2Xl`��&��<���o���˰),�4Q@����8z�6�d��������z�O$~� 4���苉]t8O5�<�CP�gM������ٷ�in��/qo�J�F,˗v/!�T�.��D���N�/��B��P�M�� `���7xm{�M�!�� !G!�$�S#�e�F�8��b��{������Kb����I-�p����n|���@2����cғQM+!��ʑO�}�(n��W���W��vda0%�0��:�t;�kDw� ����XwA�:eP�� �pψ��ˆU��U��8x�>����@�h��%��~1[ ���ﱧ&Y�E����I�ú�t�i�mJ�)9�vB!�<����ĝL<'=�~m�P��Eo�?�����fU0j�:D��l��Y ��@�E����t.���d}��]�^1,:�HB��ſ��Y0�-�ׯ�5(�x�Q�\�S=��>�|�b�W���[�%S�:Q�/��J�qJ���NKe��n9mZT ���D���Y���S��+� op>�G��s��O*سj��cų1��ʀZD@K���{hyln*l/�$g?'�Z�ҩΔ6Dc`�t���<���է������EɳΫ����CGv-� ut��z��Y��������b-R� t����g{"rn `ZBX��Зҏ5�Ec5C>�<B¢�Wb�u��s1���@���2�XXȾY�:�8Ȝ�OWYIؔ�뎂5�[!�R����s���OW�5�y��_�vo-&~�$�*���"D;�;���>���On�������Z��[0�vy�S�K��Ʈaӡ���bd��m5���,aJ�����:z5θ���Z*���yf��s���]t�53�j�s��&E��`J��唹�]�b���Z��CQ8Ӱ���(�*�a�9��;��'��P�S�b�\;\_�DB3��Y�-l8"�P�.�T.�/����n�s�8��U#wf�[�/��8���ٛm~]��1��yh�N�.� X����p��_��%Y3������E��������_�"�]��x���r�M�1B���Se�!j]R���+�$��"(Y�6����V�E���v+�3�[��dP>Vѷz8��S�JAV>ؿՠO�A��<�����_������G�1`���U8ї�����.�}5_@�����e��U,ը�!g�w�3�\0���.5v�OD8M�ѥ��"�a�܁���z̅���(��-2�����Dd)����t9��� �9����%��] =����QI���-f�*�pҮ�B���Q�S��3��Q�]�'���{�bfI��/�X����_UC�����=�Mg+t,��1E�Aʒ�#0!�(���@T|_!|���>Oے#�x:+�r��H�����/��d��&Ui�������w&ƒӶ�:L�� ʢ��HW�7��OW�\��:2�ԋ-am;�?��44g��W�ؖ@��[Iă˟x���W�jk�>X����#~g<�>�Q&C��2ݣ-�bs^�� n����"m��q>h0y���8�a��kw�i�� �/7X�BI��g�y�S�Z�Ĺު 2=�n�E�va\�����l|�r���˾Ql�s=e\:��Ke�b}{B��g�?�̡K`eaC[�*�l��9���h�c�>���8��u���[��k(5x��(��w߶Bg>(,f�e��#�XM�K���L���D[���O�<�=$�d��*�03q1x��خ�������逼C���#z��v�y㝩tj��Պ�j�nM���*$��Xӓ;���\2�0�q���4밨|�:'Y� ~`��n��é�)�9���Fו��\� �5��L���`�j����g 5�Bj�W���F<X`����'���0����;��F�ł�mb��r�çQv�[^���IX��'-�&wf^��\�=��'�L E�W92xt�2�s&h M�-�z��>�Ⱦ��J"�*����U����-�0��~�c�{z�N���j�t�ˊ�����X���?n3���Ym�3. ���j5�pK������q��E4'��'�v�;� �p��F6J�B�yU�ŏ���L��2\�1�1�o�uPQf�l$b�=��ӏOC�m�e��;�ю��dz�y��]ou������U�_ ��� ��%d5-j�t��7���n�eu����l+�Yx�,jp.V�� �$m���eOh��:���\�wTv,]��&���r�|, Y��%ۃ>���.�0�����֪z���(�x�T����n&�Q��`$�|�tTN��T�����O:���w~�X���b�(h��=SݳK�
Static task
static1
Behavioral task
behavioral1
Sample
analthunder2.exe
Resource
win10-20230621-en
General
-
Target
analthunder2.exe
-
Size
11.1MB
-
MD5
afc111d79ac58769f94c3a53e71104ba
-
SHA1
d16b1d2d35902f2e3ced8f4feb6cb028ad126861
-
SHA256
efe52b7aca7d85669e79a55968237e7b6de814a06eac275d0421698dfad9651b
-
SHA512
5c4da1632deab2e27c0f3b741cddc2453577bea5db6f0477e682273a2649ff131073a4df1a1c0f2565cf7c7702090d0b89738f9bb0f3c6fa29b0d88ffa84a810
-
SSDEEP
196608:4wNbZX0S5sVTVAvabaPhinu/Qyn00e9i+LMt4ZNNX8LsiS7D4ZMEd9R8uG6HEObv:4FS5iTrMhiu/Eb9xLMtY8S7sLyuG6k0v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource analthunder2.exe
Files
-
analthunder2.exe.exe windows x64
Password: 2222222222
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 477KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 94KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 401KB - Virtual size: 648KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6.9MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 119KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE