����w.�E��P�C��?c�����mڋ_�}�-����1���i\���Z�sgc(�̼�G���p NXu����5�A�\j� P�I�d�d�PGr{JIUl ���� �z�/�S��� o��&��`1U�����*�DN*-C��Q�����R齰4�p����� d� �2����O?'OaR�?�yn�H��{�6h�/?L�6�莔�>u�8+P�%�x��s�m���+E(~Re~��- թ��Y@f�9c���yw!3��+�)����,~i_����aL�]o��;��A����?tdNf���B�&=�ʥBN��� /s�2tBɽ�rS�+�~�k =�8�{$��8<X���j��M0}�9��Y<��G�T2HR���i&���[��>�ߐ�����/�C}!ٲ�����O��� �^.t~*���%x0�LK@�.X{7�����G{4�WҎ�������m�_���q M��9��p���/���cn!�������2�ur-k"�W�9:��%)��&qg�\?�W�'[����t� %��y������M�� h��_okl�ⷒ�����)���DR�!! (@l6�ږ��$Z ȋ��2E���ǽ�g3��%�hz��e,F>���;�;��*躃]#J_����ּ��x7�R������s�c�+� �:��Yw��K,PbM�M��0K5V[S�!#(ږ[)�)��:��/"�>�j?�����z��?�����x�㪞'_�2:mo�%�F�&C��Ȓ��x5{��=�7,:����rM���Hl-������ ��0f��]>&@jh�B���sz��� ����;��7~��������b9��G����S[�\�W�P{o�c�R�[+3WΜ��!㒫+:DCj�2Oٰ�nFQ@��� �50c |2�A)&�`,�����xu�x��|��;�9��t�!�eI F��bA\�%�v���~K�E�۟r��Ѝ�:/�>8��.j�������vj�������M����W��B>� O 5>ߵ�����e>���EJf������cq�1���`lV��u1kZ%n|��є ��8�ļl��g((���wu)L� �b�B��s�|��{�>�V��)�������)g���_�b��{H��(� ha8|,��_:�sk�^���%���Um&����`��t�CR< �J����p��������0��(��d��>�,~2Q��A�RNa3s��]�M��N5�E�����`��;T�[��B�� ���O�7祝$z2:�f �_����2@�Jԥ5��X<��D��C��"Y���{?3S��x����~�U^���H�)�=�Ź��!�����)1�#K*心צ�ׁ�~DL�,����X� �E�A�����]c)z`��5�����i��e�؍�3�qi,h~&�ãhlF�|���B;(�*5�M�OE�a���B�7�b��g�u|�a��-;�D5�R�=���jVEFbԆv�"Q�MzH�%�ʃH���Z M�*�����I>�Cp]�|�z��m�42�.�(��Vҿ_��p��<Z5s�0��c��"�m��r����R�,,�#��!�a�h������> �Z,�Fq\�5m]���[l����1��Sm� ���I$2<����Gy��T� � _��A��{�ֆ}{C�za?�z�<�w@�7}C�릍�v��(4P6��x%eM���ݦ�!0-���̽-R5�(�Ӟ" ג���{]�2D�b��*�˖�;�;7j����SJ�\IՉ���� � ���͇i�].K����QU�Rۄ�|��O� �B�������2*Sǫ�v��������L��ؐ�>�I�mnbi��Zp�꽄N���=���>�F x� �"��)�Ugf{��#ѩ�C����_������zH�l�QV�H���1��a��;��>��Ի��3�<�b�!�����C�,hw.{D?�<e�e.>U�YO�']���b3r�!�r6�:�O<g��ݹ�PϮy�NW�aJC�KPԄ>�b�ʘ"K�2eM�+�k�c���m.gx�W�m����z-kxcov��m�c���tU�p��Ϭ��qOO��t��C�n�~?�5�"uK�.P�$����`?@_��i6ߐ�5�o�P���ǣ����c�n��g:�?�O�֝8�Go�����E�����w�f��P=��D���C�j��tt��'4o-���:{�{:��A��2����q3�\J���S"�2V���`ه�G�L .��,V���siw-��ev��/e{٬� ��G��6�U�*��d���T���I>��%+� p2�k�䀂���!NUI�B~����;c��MI���G����4�Gd��\�V;����X�6�TB�_�9=X�1��-����I�^�g��t��¸�l�:,C+DEi���=(1�z�|L�,~�[�ۅ6˴� ����q�!��K/�h�`���\��~�B^�P�tO��J���ROt���5(-�U�0��xn����"�G=b���g\]ҙ��M�o{7���)z?a�ȮBC�@Wj`� � ���� �Q��6%��&)��h��TAX���uR�CK��9i���ˆ�����I̤)�u�(`ő �]%;��W��c��r��HfV�m�#�)�ʪs�����u˯��'�P�,�8661fA�z�ͯ��OXh-�|E��� ��v��U6�''x���b�e���V�N㍁�+�&3r_�*�A��}�,�YĖX�}��1�����삘dVD%�C�(�,n~�E�@m�z���w��~(ev8g�,�uC��8yO�}��:' �\���Q�P,S�֮�2�ÞX�N8�5*6>p��!7<�_%l�z"d*���F�&�Łѕ+ BG�p�v3���V]}T��C��D�)�+�tb�}颛��Dl�j�����M˛�T��m��E|�����:Mu`���cj�hG���ػ5*vV�~��_S{�D������./�m=�4} N$���zÐn�ܚx]���%L�AGm��G���7�*�T�Ҹ1�
Static task
static1
Behavioral task
behavioral1
Sample
KeyGen.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
KeyGen.exe
Resource
win10v2004-20231020-en
General
-
Target
KeyGen.exe
-
Size
8.8MB
-
MD5
744487cfed388ba20ac5e00bb1e76fc2
-
SHA1
017ed3213f054e64dbc86cf5045668ee2fa80956
-
SHA256
2247f65dd786871a36d5d4335a7c910308fabb2976be7d445dddc17be3656ba7
-
SHA512
463b312f9ae85587bf0fe84478622aa518d8098527470bef04caf7b36ac56480788ffb23a4944627fbad1bd36ae85a346a9dff2f67d6405b687b783bdee81017
-
SSDEEP
196608:RVtTJxMkM+kxvBl78hpUL665gNy806CQmxWwt:RVjykMJJ2pQKNKQmEwt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource KeyGen.exe
Files
-
KeyGen.exe.exe windows:6 windows x86 arch:x86
abf0804f4826ee29ff7d4e59beafcb1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfA
SetWindowTextA
SetWindowLongA
SendMessageA
EnableWindow
LoadIconA
GetWindowTextLengthA
CallWindowProcA
EndDialog
DialogBoxParamA
MessageBoxA
GetWindowTextA
GetDlgItem
CharUpperBuffW
MessageBoxW
kernel32
WriteFile
lstrcatA
lstrcmpiA
GetSystemTimeAsFileTime
WaitForSingleObject
ReadFile
VirtualFree
VirtualAlloc
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FormatMessageA
GetFileAttributesA
GetFileSize
GetLastError
GetModuleHandleA
GetProcessHeap
HeapAlloc
HeapFree
IsWow64Process
LoadResource
LockResource
MoveFileExA
OpenProcess
TerminateProcess
SizeofResource
lstrcpyA
LoadLibraryA
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
LocalAlloc
LocalFree
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
ExitProcess
VirtualQuery
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
comctl32
InitCommonControls
msvcr120
malloc
memcpy
memset
free
strrchr
sprintf
advapi32
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
imagehlp
ImageNtHeader
psapi
EnumProcesses
GetProcessImageFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
onlyone0 Size: - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
onlyone1 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ