��?v�V,Yj�@�!����� �l'��cn0kz�}x��b�<v���)�Ψ:����x���@�iSY�:�o� �Ofk?�{�ֻF � �d���.e�خA:,, �h|ԓ���W��}t3�D�E�Srѩ���K������6j(�.� MM�b���m�i2��W}On��(�� ��\���O�?}�U����a�v�t�|���t�¼����~A���+rJ ��2a�2]��9���ٰ�R��(v�@e�]2�;Y��H��Y�`�8fF���aC��۶+���j�N�O�\�vW�SiV�Ot$�� �ڣ��pc��`�4�W\Gu�Mo�а�E��Y��r��͟�,�i�ɑ&�K�G�h0�m�uX���ey�����K����*���K�A�i���rC�pR�p���!\h�O)]��x|�E�d�ˁ�}�^���M$�^sJy��Y�~>ԧ�.C�����:��^EҌ� ��A:Ϋ@^Į��Jjr���>ʚ �d�[� �����h�SohZ�V��I<�3���bJ������;������>�{���T��8!K����iAgiԐ���c?�Ҝ��=�}�K/6B�Li�� �X6N?�,Ժ'~�,� ��CR�(�W��[>��4�T�����p�U�8)wG�W�%8 ȹ�b��:o� Vnl�bi����u����Ї������T5�T�:���~�:�( ��b躇�Tܲ���b{��Q<�pB[�:��@��q.��]�2M�ɿ&`��9˖�/��*!�qkx�?ׄ�Є�ޤv��E�\j�����,�Q���n)�h�x8��7��AC������,���C�U��znH4:�����h�Ԁ�B�'C�^q+�&�0>c�����WMv����wCy��V�\����rE-NBh���Z~�AZ'v�~Nqo�lQMƊ�dz5����ū�%����nŊ�ǂ�rBc�yr0��~������1F�m�~:�>�N>��&˚e>�ţS��'������wAn�xp����.���f֞��'���<�0��dLߡ�۬x� �� ,E��R���#����&9�,��U�A��}>��2��s�O h�djaC�8���z��w��1OP�����U�!�B�PC�Bg���d���ĆNU�@W����4C7�zPuX��-�o>��FY�:�X�d v���[tSIe�.�����Qj���G�k]ҫٷ��NY��$��p\o!��[�����z���4阸JZO����s�I����9�BCtb%�v�����@G��z���װz�̱1��0������F�F���w=`ኄ�R���)쬧#i?v<2!��X$���_F ��$�o ��V!XC�d1�@�̬A�bNB5J�s(�Cu��- ���LQ��ЇY�����.T.Pk�l` ٜG�Z����au>uc�iGv�{���c %}�m��.8�����Mʖc�>��UMr��)��<��� R�e�I^�у�עU�}���-�r��$����kc�|J���j{M��'�,-V�Y�|-�����C\�o���r�3�Θ7��v�9�0����Ä?�7@ ��G��q�YaS�<���7���Ň,��|���G D����=N6Z���o�?GX������ >�ux=���N{����w3dP���y1��v�9�To���m�6M�5�R*���G�{_qǍki)�Ԙr��$L������cZGKX��3Bwo���(�����o*ZX�S�����7��6U�~Ǽ��>Y��=�Yx��J���z^���C�:������8�����| �I���qQ�Y�����Wm4���]���۫� -�����t�C�Dr��<\7��q$w�#|(������'�b-�Ak�3����' ���iP�v�{�@#�8�C(�N\�r���i͍�@?���ua<�B�x�����\_��+*�v���A��ڂ�)���`Pvq�)��9~�A~��>8��VLW hyC~��o��+�W���2X��b�< zw��� H�WM�(��>s1 �Io�9�}���6gq�1!=8�w�=���3�,K��F��㳗HVl<˻"%����q7��;{Z�'�����ۂQf:_�]/=�m�ST;u����G.�ܸ�>��a�!��B7�p%yb���f���Sx%ɋه�z-� ��.[����=����g�U�:�X�����ܽ+`� C/�Q��-�4]��$Xg|lj r�F�ME �5z����d���l,����`�A�Tɼ��+Ac���F��͍c�So�����y�5�9���$�. �+�&2��[��V� Lc��g�����7t�p�z7�!�Pp�*�Y���O�0�y%�Gk���є�V�ix)��F�1�����z�LS� R@>�p@/�B�D�`�p����g�k���L�� �.���t��Z�E�.Q��Μn�,�e#6n��� #��0}"uJ�%�{I��k�ۍ�c�˦,�L|<��� {l��օ��3�A*H{���ޮ���|�m�I����T��2B�)U0����Λn*���r����f�n���c���Y^w�cS3������Z�x)�Pkpԛ� `D�V:��p�(������Z����H��E��@�^��H�Y})���_���f0�}o~�4��eVdB҄�9�g���vB|��:�K�!��J�_d>'��*�Y��`�*`���v��Ț�NpKw]�乻�c���a�e��5ͱ>�Zi}̆����8�ύ��|��|s� ��h�.�e 2�Q�#Dz[�)/tH�o�Z�h3�s�E&�>L���CMGq]�",��慛!��%����·��de�e��Ƹi�y/��6y;2����T�Fys�`!����N�QȄZ*G��1��FG��R�!p�sE5c�ZRe��6�{�#a8M�|*ޛ��P�כ� �k�G��f4����Mf�� �ꎜf�]r]+!�y��s뾱yi �*�r�%�����Y#") ��|�j�� ��L��{�*Ա�#!u�"c'G]�q�����8��u�H�H_����'L�
Static task
static1
Behavioral task
behavioral1
Sample
Mindshb.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Mindshb.exe
Resource
win10v2004-20230703-en
General
-
Target
Mindshb.exe
-
Size
6.6MB
-
MD5
03a0f731d1fda4521dc912a2cd4f7d04
-
SHA1
e1e8fa96208ebe91a6259d9f51249098c4d6897e
-
SHA256
18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1
-
SHA512
2e29551ce0951fe2cc7c6aeb4bff7ff5233634dda12c8d4d36b13caaa7113188d2e6adb07a4d236d16ff783c40f7c7cf886bcb5542cbb43267d01c164c350abd
-
SSDEEP
98304:n6NB1lxxHcTX+6DxiYmpDl2yK1ERMKdY/RPl+qqKem89lh0vvi9QPyyMxoFpr:631lxx8TO6DxbmhUEh+4KefJOMU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Mindshb.exe
Files
-
Mindshb.exe.exe windows x64
7e0e18278c74e7985d2f47cb9e774529
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
oleaut32
VariantClear
msvcp140
??1_Lockit@std@@QEAA@XZ
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertEnumCertificatesInStore
ws2_32
WSACleanup
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
advapi32
CryptImportKey
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.>Wo Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Ub/ Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$^4 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ