q��1��GV,���{\l�%ĸ�(R'{����C���hI���R����e��E:����\m� �ko��v�=40������,���\kU�����$��m\q8��U,m�@ѽG�k:���0#5%�=Ž -�����U�@�5C$��������E�^u�#�˲�`�����6Y�3iM���-��1��Aq[z(�z#^�K��j,SHǐ�0Fj ��kCq�8]�va3����A ��sP�`{Jp�o���M!��L;`�PW�3a��*���_�R�:����ޥؤY��q�|�5�@���Y �r�R�őu���r��� J� ��i�<f�t����I�]����g�h"���D����4O��(�;x$�d.�lBlR���F������҉W��#R�������-AU��+��[�W�0,�p6�H�p�����nW�����M�I��������bOS�iD���|2,|X�~]��~ʢK֜�C��4 �aq��6n��ݹ�_�Ƽk`���}��Z�Oq���x%���d�������-��0�4�8^������a9~�=���,$���o��n�\��?b{*�l��Գ&�#��^�r��M]x�t���&�W@"��ȧ�����7�h��0R;l:����AӴpm�?V�� �[`��|N�ؗ8���8|��M�*ؽ��@�"*�&|�G�|{�f�����R��:5"g��h�h3߂���!)?�D9g�53�ȉ�Љ�e��7��Ṯ2��T������쑾�����]�ѵ"���0�V[r�" �&@��[,^�� x+��tD|i���k������:+aZ�pù~@����/+���;썽�2�~4��А� K�kn � ���Ԙ���(uU�r�Q�Q�#��� �]D `{M|J�1��u�Sg}�Į!U�(f�(�}K��ϊ������+�Z7=��A�E����v�J���|��m�1��%M�l\�;��a���W�8p�C�?��1���bH?�rI��8)�>��A<���z·�o׆�عG;���s������=F)�?�2�!�� ��!���\cJ�pфC�5.�&f�hEz�2���v�<������ �����f��/�k���l��PB bk�솽�EɎ/�$K�ֵT��n�Vñ��\m2 � ���?�a��H�����^d2u��E������Ʃ��L�\��mX���U�U-V&���}E��[[�K�3#~�����g��A��$�""�_R $e6Nk�ͱ�:r69����yYn�8\�()�A�k+d��Ԯ�����oR���/ʖ�";��-��I&Co6C��v�[�N�!Y.o8[���j��ƾZ݀3 �������Q���h(�>]�/�UR����j��`�(�ok�;�����Jx�Z��- @V�m�����3lת'��� �Y���.�8_3/�3�t`��|B^h�#и�gN��3�CG���?����\b�ݺ����C~� ��"��q-I��a�; �7��̏�+��ZJ�ݠ�F�W����]q5 େ�ڼ�拕3��n�25�OC'iw-��Wt$79�����#;O��2��:N����B�֒�%����ac6hwԠ�E�$��L���"d�`KB�o�".�Z+~��~l�ih��&������?��Г������r1Z�3S����a%[�wL�}g:+B�Q���dc.���w-%}�\����~Hxظn���8��0���߯��ט@�\M���8�2�2�(�-n�˔ێ\�Y/��p#{����zr��t��\�f���/����{o����q�`̌�T��c!��V���C@#-�ڪAњ�<��Y�ʼoK��� ���� LQ^�c0d�( �+�C����@N%*�L��~��zm��{ ̟�;�3|yg�B�k)Y�EK�Rt[i�0�r��@O7�� ����VK�+*\w)�j�X�����Y+cZd���7@9�"������F� �g?|ӅH ���Q}{+�ry��[.�f`E�pҙ�[��� ~ج�����}���:W6't�wM8FA[<QX�]�����`P䳆a�+�R� V�v�6��q�*/l�UIl���d���C,�@�wM��ᤥY�Q�)�R+kƲ8�8��`X����m���ܴ�j��FN)_�*#����ڸ q*^<���P��ニ���H-�� j|*�T�+�_������ b�b]��E����TJ�M�5�ZJ��v��������,��F�Q��(U⚚��D���{�v� !�v �?V�?�DEt��4���Ϊ�=����˹l�W����U���C��[)�P���=-r;�OR9�~f����d��ﲧ�S.6�irY�S ��=�P[0�������?��=��ؚ3O�4�0a^V{�̸�7km���=��W��y���q㍈��N�� t�P%ơ!��+<b��� �,�b�s���]D+5h�ۙ~몁�� � ɿ��A_�:�EfV-t� �%�9�m�}[m���+pq�=���Q?��fŤ��K {_z��T���txX��N�E.�zY��w��6���ЖX=������G}�R��U�6� �w�P��@��F۷z����sa�������/��-�����g�_ꞣ~~c$d���7���J�n�,:����-̬��=��b�^�J�T�X�e���S�OI�%z 3']y��Dz��{��+a4����_�2���v)U����3�����x @��U���?oUSԀ3�H�0Rc||B������' �{Q�m��ҍn�� �T^ؽו6�aa���M�y¿x��w>�����2��"�tB.Y��M�����V��Y��n��i���i,�#���3pK���֓^d' 'p��g��p�V\�$ e���]r� �<� !<�����7�Y�<�����ήXƐ&՚n���V�BgtG�JGOa�S����tfk~�k���[=,����d��u�7V�5�x.��\�篲�l��)�&^�s�ř@�v��Rn��
Static task
static1
Behavioral task
behavioral1
Sample
cuzin.exe
Resource
win10v2004-20230831-en
General
-
Target
cuzin.exe
-
Size
11.8MB
-
MD5
5845bd6c6c596ca2ea2320f2ebbd7d55
-
SHA1
938782b049d138a68f5e4576002b6f046a0340ad
-
SHA256
f729dc3037af020e6a078342386fe39cf6507a31efdfb6d70579f64ed3d26b04
-
SHA512
d5fa0af99bfd821aad455120253beccb5bceb6c7dd905fc8005989a8d2c13f44de358c33ff7d79ec6f7bd9299f36f70666e8175fb1a1ecb093fccba7303e1890
-
SSDEEP
196608:jgbJbnqUavQVV+2WVCKbz08te40+DgBjsMT4jvet1qhoKLfDR3wXnDKFtVP5ovN:IcUavulUFbI8te4ayMTMAyLVkDwTP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cuzin.exe
Files
-
cuzin.exe.exe windows x64
7963d3a67cfe4f19646b23c68d457d1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ