�{��Na��[<��ZWv���7տф��!8T[x A�_ꨄ� �&�k/��Y�ˁ�?�?f��| ��ζM��h����?`o�+|1}ݎ����,(��Ȃ;5$0��д@b/��-�i�rL�,��Um:�J ʺ�3��-��6�lT���\�q=��z�v\F��7F���z��0��ONq��mi�){�iu �b���H�(�������5����+/@ç�yz�"3F���W�^̺}��Y�P�ۋ����"u��I���^ao�7����O>x�J��#2���Y��^���m�A��WVq8�kS{H�j#֓���*��������΅uu�*�� bB����!j)�lHH8K ��&�d-І�����*.�i��4 �?ڟ���W`���Mk�b�׃O�G�s�3�6y�ck�b�f{���wHW��u:��ŝ����?������9�Hia��wTs13 њ�ߚ�o Z9���~��V�{�[g�4@�4ni;xm��'XǛ�3j&ɸ��]6�pG�b�tؤ���z��:-AҪ�݊J���[��2=3��d�EK*=5�x?]h#����l�'���"y���\���$P��{��$��7�v��h�0"_�1�/3�������u�1|��I�uTR�%���L�힋��&d1d!��nd�S3���}�U.�E��Q�ڿ�3���������l�� �O�����j��?jhep���$�kr� �����b�#���g�[���33�{��NΏ+�-r;�'��@����7ö���FՑ85`"�BR*�6�����=/[�3�j\F�Z�Z~� �Ř��zB�A��|Kg�&H7w$Q��ZJ%�Qکk��K:��q����l�� ��pR�;z��ӊ��~�Oefl�\��)ٶжL<�����9L��#�8��A�v�H�X��LR�e��a�`��߸|���u�ҿ�m6��'���+���`~����Aɤ�Ќgf�}*�l$c�U��])&x3}���5�p����)���z���+�o�: ��W�8���/�(� ����W�$x+������T4~���N�kI���k��G_��i%��k`>�];����vJ"�قz����I��ha��얆q2��X����UW���R�,aI}]���)� ���f�T���}FF�|k�Яl���oIM_��)Y��'s!B}�W�Vm��Xq����{u���h�p��in7�������f���Dz�No�s��VyE"\�<�!��`Fk��,�˃}:�g�uZ�:Č*�U����2-�?B��~�o���[V7</��� .�仟��V��<��U�Y�m��$sێ������ ����!Wԏ>�.��1�v���\?G_�X1����7Kq0#F�q9�鄫��:���lL/c��e鋯x��@$ !��k���W" �:�����*�(�$+��@��cf����z��u �>����n�pf[-Mh�L�?�n->���W�7-*�����_���e��tGon>��+�+=[N�/��E2ME�b��� ����l�`#Tz$<�����\�z�;�⁍����D9�$��f����e�t�>�������1�xm�k�kך��W���e���,�l�0������=���T��v���?�Jo�#=����x3��cӆiQ+�n6J�� n�h!�����q�툿�ZxZ�;c�84-}���[Р4���{���^U�3�F=�*���P]q2.*�� ���i��?8�;����X�+����O���=�+�JE[��e�]aW��qW�o���~Sk����&�D���XJ|ډ{�kLR�L� ]�J�� (��E Qf��#�3���s�o�+F�F�(<����P��į��Ć�!����q9�T�m��8B�a"T*QPm�8<mXDB\�:E�Z�S��:�Lz+P�J��H���j'[m���)���yj�v�������N�^AJ�n�m�_�NAؔ���]zP���d�>p�ݱ���{���W�Q��W����$����)^�2�~��)�/���vO'���]���iC�����$K�o�V��5�b J� ��VExz������q�a� 1!��\7�@6` gvh�D%K �&�3����LO�*� ��n������'��^0�o�"��I��� m��VgD'`��/>M�k�)=��-�:��I{V5Fȭ�|qE� u���OyIBּz��e�q4��^��4��s�zf�|����Q"ȗz��|� ��� ��/~F��) m!�)u7kݝ�,M�����>�и�u'��P�.O4~��dV=��h���I?�� NBў�w�M ����p� ���)��:<`���#ؕCLm�� `iE����J-PTN���f-����h쑩�'u�~�1��)5f࠵{C�C��I�U���m4E�G&�ۚ��|�ck�o��H��p:i��y����CM���@'xؽFs�����<����jR��°�d0A���*H�e_�ה���?ƀ�O4E�D�6�n����>U�%��)A�E���d<Ή�L���l��!���;ȻG����Ȇ��������." ��1�..�%H�g1��zO��L�`c���Y5�F0=��R�Ҁ�??`����k�bL���c��XVX$8����)�-���c���j#9�(g;OJ;y�+]2l��W�1���<h��Q�ݪ�@��\*7�:�<h���H�����)<�m�j�>[4���}��d$ro�f$���dd��I�hWl}�E]y#dz�D��.GS��hSO�!�����bc�7�R��Hpo ����@��㵘��x�@�[۷�ey,��,�(�W���$��� �P`�[7>*��Kxx]Q�Q��w���|+�7X8�G��SD��jͫ&�� ��8�j�����Q�3C�n�N��W�e:�\9L�N@�Н�@�����/���;ji�i��Ip^V$a���ԫ�>�� m��|y� ��q��\��m�0��p�Q�@� '��T����BQ��*�Y2�u��3h��=̌�I�s�ꔸ�U5�c&(��2E���l]p ��(��>펿U�f�8� �pNO�i.����ڝM���vUH�ݳ� ��
Behavioral task
behavioral1
Sample
RazerSynapse_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
RazerSynapse_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
RazerSynapse_JC.exe
-
Size
5.6MB
-
MD5
28833c2c2f11d7f5bf184ba75e5fe85d
-
SHA1
c37c2c32e980facf98f1c1a756eb1d6f48817e8f
-
SHA256
52ab2c2ff02a1f69ce5cbbe17b4c98ee62f37b1507c14b4574da012a2e3eb5d7
-
SHA512
6198ecb271be29b9e8bb91d4c0a8a88d738472456fea497aec3d56d5ddbbdbb85fc9a549b6f196314ed93cf288465a117577db58f43e7feca3b273f3bd13b011
-
SSDEEP
98304:2bY0k0m1Ckswpguw85fj4hBb1OSFAFllTSPE2Zap9uLHlpNTo84aRoSDb:2brE12Wgu/8OuAFllT7em9oHlpxdg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RazerSynapse_JC.exe
Files
-
RazerSynapse_JC.exe.exe windows x64
b5e6dfde85bb3747b4f612fb8b8273db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AddAccessAllowedAce
msvcp140
_Thrd_detach
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertEnumCertificatesInStore
ws2_32
htons
rpcrt4
UuidToStringA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ