k�c/��\F��̈����C� 7�UM�}N�s/�"��0�_&�A+Y��;�]����G�lc|����������O���ſ`���TE�m��-�%���$fx�j��y�N��,���W3��^�N@8�>v�F�W̭o@�[b��D��l*/�"|�ZT��I����}U?��3��I�}V~��H��������K��eh� x���m9�fz���ϳ8d/'Mi�����z@��b{�*H�ex�yY%������$?w��9.��Ȱ��W����'wrni�T���g���&�*��O�G�=�ݐ7 ��E9zP�N�.g��֓���/8٤U.��⾄�a� �g�Z�\��о���-����؈�bW����Jõ���I$2�ȡ��K����:'R��u�� >;���a���!,<���p�]r~e�W������RSĠ����b�VPon}�Q��^灚C6u�O���oJ���<q��ʈ�0����9�۷�Y58�U�$�%x�4(n�ыH�J���Z�H��h�~)�)i�]���{�@�&����q5��b�e-U�}��� ��w]��"ڢ�1(�����l�g��l���5 �FGvj�B�a��,2R�B��:f;̿�n�����Z�y5�[��L X����V����>�o�`�Mr���/J�m����?��n����֑]��-ʁWk��ݨ'1��r��,{f�,�1��X� �:���'���Q6���+����y+�HFc�� �=y��hZ�<��� Q?��')���YΉ`�Gĉ��� ��<g��rf�* ���"Y/��UJz�W��ԡ�`��� R6�ϮZ�W&=n9;���� ���=qwu��n�����f��~3P.�����x�岹f9�M*X���0'�"qn�-A0�sT��(jp��#a��[�_�����n��+�1Ѕ��0�mZ>or��Ҹ�n�?@�ض�z���-3�E1�w�����wRγ8����+4�-����T�j��|N=P�G�2�q�����h���Eg$���/�R|H��>���zH�w������3�r�֢��x�ڳ�I������a� �L@��!϶u��(��ԯ��D��g��Q���b�B�bH%��E�<��R剉253��ɩ8�H"�AQ��N`g�?d��zt�k~u3>�w���*к���B�^_J��B�b*��g ��Iz�E��_��}��rB7S9�+@�HI����Მ-;��D�P�b��·�B��h�Kmx5)·���Gu�a��;�� �eþ;b2WCj��������3%�����/���*���"���ph�^�;�Zr��L0_M7�ݿ� b�.�p ��4��~=�����s�ܡQ0������ܐ�X�2�p��cQ$u��_{p�ޏ�IW)oyb7��x|&�����E��ib%J]�������|ZY�yw�q��]�a~W� Q5�ڕE��v�FNT��5����<O�KD.��WϜ�cYy A����;Y��4}R��5&�!�B5�M��̩�J�Y<�8U�frmҿ��9����X��Eis����������.Q����)���V����7<�1��W&�����h+l0���RZ�բ%��t0���ٵ���Fbn�KaJ��?i�6�)��"��F�f� ��̫2���-a�U"�p�Q���d���N�qZt���(���+����R�����US����C�[�~�c�N�Xp]ݍ����z�C[�]Ըp��+H��Xm���T�bhu�so �C:F�s�M}"�����HBO�"kIMC-����ڀH��O��<MX�uz��~&J#8�D1���p��|�bcq<DPQnˠ�.�8Ȫ+�V�,��v�os�V��#o�_�R4�'f� ����O���1+�����֗NL�UX�299�������T�]����2����o�4*�9T �!E�B"��|�������<��w�3i�� H��K�K{a��Ny-U���:��53?RV�s�}����2�U�����~�ȧ����Cy���N��ŕ�E�2��$�#?���;RH�P���Da��������%��7|1 �*b�@{>� 2��T0[Vt��(J)}�*�s��x_�����8",iN�ڕxt��?W,-��y8ftǴԲTAw��z��R�y��>�[6�U�x��1������k� ��쉸D���l��|Ż8��ȠbO��|��8,W˵���� ����m�'������E������Ͽ�&�r�vՖ��_i;��a�]���R�PT�.W���_]N�<�VwG?��\Vu ���*:J\ ^�p���� �M �.�� ��ű���+���^1���Ż�ZP�f��#�Q�d�]��$�)ف<h9����CR��r�F������?��@s ��� d��+�3x�TDe�"WD��]"�7������j�����>oxı��B�n)��6���=Ӄ�|zd�X���}ڀ��]Zi�Jh\��r⽧;��%���z��P��nH���6�,AA�q���� �(�@�_�I3Sn�>�h��J:R��_��ٳ��������l^q���D5���I�,�L��O�564�������P�gɹ-��"�F� ��c�lYZ�<�^����?�4�7iNW�K�?Ⱄ��kz�zXvG/���X]|=��%�ا�e�Z��I�#���'c�R�)}v�� �R�};D^,�K��OU�P#���U�j�o�K�"e.!yQy���SG��������3�[x��3�i2O;��xt�p(a�S�IDQ���8Y��nz�����r?_�Ų�tװ�H����2��ܽ7�.����8���N�h"��� Y0V�$b���ul��g���$� ����)���d#x謹oA�ӂ���[m?��H� �m �q�����w hfi�(uс�Qv� J16D���A8!�p���|�m�%S�D��m�S����}���V��ViL��d�cpψI>!�k���.F] �A.#yUk+���ga/[R���o�FC��M
Behavioral task
behavioral1
Sample
sadio3d.exe
Resource
win10v2004-20230703-en
General
-
Target
sadio3d.exe
-
Size
5.4MB
-
MD5
a5dab1892e8be7aecf1923f41e16b619
-
SHA1
ceda17ef6ddb899eb9406a1c10eebca902e60f18
-
SHA256
d4bfc6d10803426aa544a6d1b4a31f9d545800178b5a7f8367f30bc9eb415820
-
SHA512
14c9563877f0e8ce891ffe8efed6a3252631f7c5abe434b8539102d945f14f8c79476d68919ae6459347cce36718c5eb51f34e9d3bbcccf15b686530dc2eb876
-
SSDEEP
98304:vjIaXDh6+wOaOlfgLwqxd0Iz3POckkLCTE8o7N1rXILJ0gA2KDRuCEFl/leGb1I:v8aToOzfgUqxLz3mctH7NVyoNDRuCKly
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sadio3d.exe
Files
-
sadio3d.exe.exe windows x64
f07af65fe6ed09e598eb4d3ed06c5538
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
WideCharToMultiByte
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
ntdll
ZwReadVirtualMemory
imm32
ImmReleaseContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ