����(k�ɀ_ե��6����`�ʾ8��l��2��8��dr�j194��wA�_�X"فo�NY��FG���e�ΐݰݔ�pT�����}�l���_5�VΥ�sn&Oн�b��b�)�>CJusy��m�X(^c[�Zaw��U�+��H���1WH���X�jjH�������u��[#iu=G_'���ůN ��ˤ�>��O,R�ln�3��Dҧ4V���q0��av�4��C0�{�p���9�@ �p�ϲ�&�<��,��"7T�D��}�^��3*-ܗ\��/�~�I��/��O�Z�F'6�Z!<e��Q���MIH�z��8ʂ�_�t���0��Y�� =�Y�8�a�� XE&��rՍAiR���r�;@�C�J������c�\7��W�q�������`�=�r�ıo�5�=<�!������t�v)d�Y���x��N@�����)5�^�p�8<�%[� ����v��<�Q���g�[�M2��EOT�T!�ø4L�˙&�A X��%��͏#;2P���♜�(I)�C{��u�/�J�X�i^*���T��݁���MJ�t��֛TeQ�J9O��*��=�=}��`����|��;���eq�6��p��Z�� � ���?�-w�B�Fz��k��ܼӎ>+��q-Z����_. "�&�3�j��-��@�����πU{`��#�,y���̓����������ʔ��t=6\�&{�vz!j V$D�Qi�I��z���}�aM��h�ʂ�O���Q }o����Sm*�d�3��p*���f�����9�l��k4�ӓ�A%��B�Al�Z�w��c�����ݒQ��Nh+I3��ڑ�g6 ���tJ�7�V�8FK����C�B�5�[�G���A������@;��q�zN��o��ʼ^W�2�4\l���V��h�A�l��Цb7�7��T<#e= � ^�z�\�xn _T�SO� N��w������?. W����J�0�F�æ/����&�Ϯ�\�Ag*�����2 �slӎ����� ��R�?�f�\��w��ym�=��{�O9k��G�O"�2�Z�����L�#g%lnC>:�Mu?w8uN(g�%���E �Wڸ- �.�U)hb���Uj�P��6��T��h��TS|]��S��: �`CJ����L9�̞�LF����s�����w9���Sl��>��{�FE�i$v���A��CQ�s��A���yfXӹVI@�k:k��<5x�� v��"o�O! ��''p�Z��[�Z��w��9i����E�@M��� Sϸ�J$c�������6AW+p�쉵��-�h�� C~�?#���ndsB2>g��ZV�ӌ ���g��XW�j�A��C���55��*W]���Z�������a�(�̡{n�!�r�jۄ�G ���R˱MQ���9=H��>�b�t���t�C ����.�T� ��~Θz���ț[v�'�<����X�s�?"�Rr�/�'.x}���l�l}.�j|���\����$�kU�*��R���w��=�ѵ�������`d������D|q��� �l�<80v`@kV��(�j���E�x�`�)�"�@e�M��,75/-evޱ�XB�U5���h������bݱтS�,�8`<���L�kb���3�����z�6<�R.��ޠ9�Zն�ġ�h�l�^�b����SUY�T7~ � �����R��K������feJ�2æ��];�\-�t>^\wH�(�S�4՜�(��dI4P8o>���� Ǘ��~v^��ԫ���-��k���=�-�6���Cx�"�i��匳/a���c�J��};�� CHYk;�ޔ#գC\1�SO+��Wϲ���i��+�C!�\g��=����<���C�Bа�����@n�Q"���$��3h��L�;�X�2i�f�S��n��ڬ�c1���V�cw��z�le��ή��-�]���0f7?�'�$�T���>���C,Ê���r���::P��}q�E�8z�i��N/�ָ� �g�c�hV��*͆�|_�ҟ�=(�㕿�)��GD}-2�s�eT��L��-��5x�������=IhOdƔ�U�6R�\���A(�k��0�J�d*}Ǻ�<t��*|�]k���Oco?��z�QRg�S+����9�g���)�A����d ���cIU� �f���V��sL��`.�������_sCe[���]:��/�/2�"�(�4zn�ネ�MY�7Jy���c1M%��C�����6V�Opʹ���En} 5�uGgc��v��G��sJ"�ۙ�쳠����v�o˄�Vw�/�T�ç�2�{9�����i�]Iw3NF�Γ��P����"��h��#�j�)ђ*�99ޗXo��WD�c>���`�q�4���O��\�H������Kf�tj�>ߨ����p��b�4��{�����¾~f:E\Ǣy�,�nj]㛯��yu���ei��"�ݯ��UE�� �sW!̙���\&3M��!j ��zSU&M~^�H��Nj� ]d�(���fTzI�O!iu�ob�gbz+�/���q�l�H�X^M����5�:H�����V�`��I��pɴ2����k����PX1I�<�$t� Aݑ'��K���o�X��L��R0f��G�ټ�M�y����F���XdτM�0$����@y7AK��(��LF!���m��b#��;V�V����H���c��i�j�Ќdc��Q�������X�#��K{��dMЍ�+�+>� [FO��a�硫�;���'i�>u���h%�Zs"Tb�W��2��"|�<�B�R��������W+ٌ�]G�r�uUZ+_I�$�(H�WH��~h�h���}��)��4�i��Y�>?"���{����SBͳ��J�AM9�N=\��= qS�!փC����G"�����рZ�5YW/;��#���+ #�ʏ ���9�t xZ0���)k�n�����4u��tgƚBHM�:��;�7�����Hq�G/����PrZ��>�ʭ-DFxR-����6� ����7#����/:T!O�j�V�������x��@"5�ݙ�;������
Behavioral task
behavioral1
Sample
Rigel4CS2.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Rigel4CS2.exe
Resource
win10v2004-20231020-en
General
-
Target
d739e2935d10055bd1fa3352447c8312d6fb712b9d814c213bc9e43fb9e5ac8c
-
Size
7.3MB
-
MD5
0833f0c66f761956bf6b049234f62e26
-
SHA1
23fee1fc649b5c088e58b1d4f37600c1acc449c4
-
SHA256
d739e2935d10055bd1fa3352447c8312d6fb712b9d814c213bc9e43fb9e5ac8c
-
SHA512
4916c8622ff6e6bc5945f8a3125a5ebe6f1116df3a5bce8ee37d0e1b514d7b314d896a37e2399b5025182e3cae9e94bbef39fb1d1090ef3026a60aedb287c394
-
SSDEEP
196608:3byUp1Ebxru/OmGNAMvCJ5M8aZdEYpxZhImwaUqxpTX4i:r9p1EtuIa5CdEY7w5qbp
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Rigel4CS2.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rigel4CS2.exe
Files
-
d739e2935d10055bd1fa3352447c8312d6fb712b9d814c213bc9e43fb9e5ac8c.zip
-
Rigel4CS2.exe.exe windows:6 windows x64
b5cf0533f46fa2f4d8c19425e5122450
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord211
crypt32
CryptQueryObject
ws2_32
closesocket
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
tolower
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ