YM��65��{����b!��@!2; �?'wEW�5?��# =�&FV���,rS!�I5��յ^zL���������9x�h��K�S�U˞.�~�_%�s�#Q≥�C��B��d'}�Ftj&�x���%��ɵ^���~����E��.�-Q�t��0l���y�Q�I��9=f�a,�x�ZU�#r���M��t��=��D�I�V����t��������nw��,���X�Aos��z.��g���� !ycΉWX+,t$!�wӷ�A^��n�|�^�!��K�G�y�^%M/�g4�KTa��J�-�G����;sM,/V���ҩ�NU���1y���& c� i�]�K�\��x���{ƽ(2K�Щ���<U�ks�����x?O���`�?�����X�}|W���E9��35x�q+������-NKh�/m#���߯���%�V0 ���H�'���T:svT��1������ߚ�_YɎz1���i̇�,��TBe?"ʮ%��F�JL�&;�~,B����k�F�|E�@�PsF""jv�E�8�hVUV%�>�T�]��X�p�Ă���z����tS����g��f���N���x-�T�,�,K��h ,#�j)'�H;l��%��q�e$c?�p��R���+h���sW��*���$5��%�k]sx�����}�;H��s�&P�{����A��Q]uܹ�D��ʍ�S@�J�����`�E�mV,Q�����l:֥j���n�%�o)�8�ˀَ�D(.��O�ʰW%���k��_�biA���E�������U$�&��;�k����;Sd4�"-je�EM�SJ�VD �H��oگ��k��IJt11���cI��;��n�Q� ?�n�@�� �N8Q��}��J��AI=�q��H�ԋ�����C�7��c�D�ީ��/���/ &��.J��.h8d��_E�G�ϱ59���Z�[��ӵ�jn� ���ކ�r�հ�0S~��DV8@v������k��)5$<֜/'���j�n}?[��G&/ 4x���"�&��1����������D� �-b��1hX��Cb��0�: ��E@~�WҞA�;��YH8:��M���g�3W�.���|B�gi(� �q�Ā��4M�uS���Š�;� �/=�@ �R����^��`�d]�I��I��Ǵ��?4����c��P>W+6�x`jP_4�$���A.��6+,~n�;0��сfc�#>�I_��)���) �j�����F��?"X���@�]�����ʣ �`<��]1�Y�MՀ��oUz8f�+7Q�1xs����3����'0����3�ʍ$�J����/k����,=>v�����0FW4h�b��Q��1o�$��@�f�p�Z�`�d��w���1-Ke�F���Z�9���tCVh��S�_q���ǭ�(@�@B�3�T��e���I����ahB����� }���U�!Og.n�y��)�9�|���K�X��a )WgPQ������n<��_{$�`�d���ߟx���B�ڱ��#bp�x�+�����F�{�%1�L���b&�4w���מ�k�#@�6�A��`�d�|G�":�N���A|�TPqx��U}2E���R�u�)@�US���#M��i.NW�Bn�;�ZP�^{S�p:δn?��J��W2�c��xD\�{�baXN�Z���1ck #|.� �[Z�&X�`�0���}���¸LI�9�}�5��`9j���N�F�n��kA�pd* h�����Cr,���ջ>k���;���.��BP��pET�F�9����U^�4��k��6��R����~+���Ji��镍]1�̲��? ϝ�������:�pAw�Z�`"H���m�I� ���f��-��h���t,�ZYKy-2o�r%͒;r9j7�[���~EՒ>J�Ԥ)G ��qgrR��@�\]�Z �nrZ'C}(����oy�7�3i���Y��w(j��X=]8Ţ�"Ȓ�X�o��B&MMt��,��!�2׀粥���I�>e�����&��튺�k%K)�(ߤ�d�b��9Qޙ���;5w���y�N&ϭ���p�����a��eJ�$��骃�ih,o(a�hq����-�b����]0��:͢�R*P�r?���Ӽ)�A�g]oV��'5&q&/(�ٿ��t�J�������5��xw5���b��� X���*{���&����ݸe���)��K�o"� )R��Q8���Ip��X��;j��)Gw�;Z����벍�b�� M_]����[��v��5 3�{���2�N8]�džr�:��|�CL�S�F���b��^�lDw���mU�"F��҅~��$�}��|dt2.�m=�V���⓪�iץ[�D���%�Z��>m@w�|�3��H���!IP�����M��M3�c�hQ�U*����7(�E�����qGb��������ȗ���� A�H2Z�0_��D����aν���?�u����'�:��b�A轲:j���A[�(ۭA�:����*�q(��PSs)"�PKa�z�<k�}���i��VG���9y�x��m�G�_��'BK��WŢz3/bDޏ�(����r��z�T�v�fڼ���kҍ�Hc�>t���v {&W�eT,�*TaG��ߒ�ɯ��1�D#�M�n��z��oK�o�/U��8������9yF����c[ڟ����h���&1~�L���{ �v16l�M�hڵ��1sSK��1�^d9i`q��m�Oq��^�� �� =8������Qd现Lf����T������X�$�,�f6��·�������t�I ���F�^�x�X"�5�D$��@ QL\Y�[�����f�z9�Z[]rK��"�3�l��n��!ϫ�T3zC[$gՅ)��QJ+͡/��b�LdLaz*��0"u�|J%܉t�%�.w��D�JU�$?��Z��g�7�&�W �N�� Ch����>+b`^���΄���v���)y�͛�~[�� � d�s�y�;Nk���, 1u�[����7�K��!�,BE�C��6�.Ct��
Static task
static1
Behavioral task
behavioral1
Sample
umt_card_manager.exe
Resource
win10-20231129-es
General
-
Target
umt_card_manager.rar
-
Size
8.3MB
-
MD5
ae58e3c9c3f51b97763e512dc708ca09
-
SHA1
ca24b96e7c284a1e0b5be296eee9607a2e02c74b
-
SHA256
d713821622392ce8b89340bde2064f67e5406a2f173b554c9120912f7feeda40
-
SHA512
d2617198e27aa511df951a89e4df2ac113c026e71007ba793e1404e08968e3d95c9e2b18c33cf2d4bf90858f8e72eb5f7a770e015795d2b7e7102adf351cf6d0
-
SSDEEP
196608:xS6z67cIAXGO4+E0UpK8i0TvJNaocTvRHDEEiSPfBjK5lUJF45CWE4s:0HcIAWOTGKD0TvJcJRHAGnBjKQJO5C5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/umt_card_manager.exe
Files
-
umt_card_manager.rar.rar
Password: umttoolv2
-
umt_card_manager.exe.exe windows:5 windows x86 arch:x86
Password: umttoolv2
b44e30b5341cb6c125d9d8a9e02bf719
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
TlsSetValue
GetVersionExA
GetVersion
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyboardType
CreateWindowExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
RegQueryValueExA
oleaut32
SysFreeString
SafeArrayPtrOfIndex
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemFree
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
CODE Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 36KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ