Behavioral task
behavioral1
Sample
3944-252-0x00007FF775210000-0x00007FF7763A7000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3944-252-0x00007FF775210000-0x00007FF7763A7000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
3944-252-0x00007FF775210000-0x00007FF7763A7000-memory.dmp
-
Size
9.0MB
-
MD5
79df4d9125a0448c03b4e93ed997a56d
-
SHA1
71f916701cac1d9ecd73d2ae7342b3a56b1647d8
-
SHA256
e7d6be5f3d1e450549f2f5bec9be785b8cf53f5090dec654e4722e24f61737f4
-
SHA512
7df1219275d403ab55717fc172963ec655021f16cf49fad9fa97ab73d5e5d2ed08291e8bee77fe04f4036bb464dff4e2a1444d8572f8d07a53f06616cd67817b
-
SSDEEP
98304:dxrKaZ5tXoO18zgLVEWDq4VaNFQMyzIC6W4J:/OaZHoOsgLBVVaTbyH2
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3944-252-0x00007FF775210000-0x00007FF7763A7000-memory.dmp
Files
-
3944-252-0x00007FF775210000-0x00007FF7763A7000-memory.dmp.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp+0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp+1 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp+2 Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp+3 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ