vW3g\x#R=�:6��Q]`��P)B��II٘����0��%L�ky���p�2�-�����V茗�dϥ5 �hۜ�`GUdC������MZl�kJ�:]�� ��mK���Whe�Q��?�/ L�3�r:;@'�g��wL�Z���k��t����;L��t�ޱF�c+_k"�� �7 x�Kr���2�2�� ��ӏ[h��w�梴��݆h�?K{[С�����g���8�L����s�A'M�crEx%��FxIm�d�oM�E3��/؞ӄ�:�{�5�bE:�Q���XPE���R���a[|F��P�/~��8Zr�9 ]�GDk�؇���q�a�t�[��n���w��Q���� _��ܬT��P�@������AC��ٹNGr��n�M�ϳ�T��7.��[)ȧ>7������}v����bSI���|!5 ;����s���>���*{��S�-$nW��#mಋ`� �w����?�x��7oQ��{ `�}����@�О� f#�,���L���r6�2�m�7�%�~Լ- ��r���x�iWYY� u_����T��.��M��pE�'�[h)pY[xsL����2>pkM=@M�f����l*?��� #�Y�Ɏ��%��d��0<i܋��i�� ��s��Ny�ο}�͕#���0�!���<���Pm�&�/y��Xp[^Aj��h`�|���s�A_���&��5������c"+� �:���=Z����C��|��l�`���@���o]��l��\�M��JMB<g��Z����c�qՊ�u��u��?���u�Y��,~{/D�T9��x���^;.$����xkͻ���x�ྶqq�6cH=�|�EPz*r��_:�`��$ఊJ��W��s�l��6���/u?�>L1y&2HK�'�P����M�_w��t�8QE�EfX�K��0q(�6�T\��T�M)��3��R��R�����b�~1�����WF���{<������VXMۡ�S�ݓ������'%GqHm�f�,��e+E�6��VV��8hƃ��"�#�(�-7��C��&J��(˧*� ���JTO��X'��un9:S4>�.�`�+{z� j�Bⴰ�t���pa0���i���A�HyE.�{l?U��<#�l.�r\*�W͡� �O����싥��n��u�ٸ�?6B�Ō���U��F����S`��؋@�̠'j���)�9J�w�B��ڰ�&�)c�tv����sVB�˰g�u���2��{5�Js�����N �Mmܥ7�Osج����P��ǔ2�9� V�Y��0�Й�W���K=X�3ؒ��OJE�;?�H����B��N\c���b�)�FT����ٌD����/����vZ}#�#k����d`��ޚ�7�r�Hq���Ǎ�Tm�ԩ� �(&=�.�n�]��E��mPJ7F�e"���7��k������ض�Mo8x��rB���"ss��H0���E�4�`���a���A� 8��(�=�Õ�"N<�7�Ⱥ����EC� ��x��w�\N�<���߽&I�֤�z4�TX�c�2��g�߱]lX��DK�ZOFa?T��<��hKTUV�K��7�X�.' �7�[����%���V������m)�s���b u�%{���-b}�W�_Ǝ��&�P�пJ�����LX؉�{�.T�م��h��Q�<�~ ��b��u�&͈E� :���f"сƃA�9��k�\�fۺ�s(�q`�}��1�|E]cB��sP��J�1�iC��v���:����cm��[@,QP)����k�ou���b���m'ҹ�.���ķn߁5�t�~�D#��<��i�|���Z�1��,���_ʇ���j ��86��;j�*#X���.�p�ݷY�����<ƞ�!6sn/̭�L������b���Yi|�������YY���-�`5��Y���8"N�d�� ���c��^n��6<��c�T,mE�(���(���K�6JqD8M¡���P�� >x>?�/IU�u �dS��@�:0����\�����`����tL�8 냖��2�vq/i5$X �t�SJ��V�YJM�^ƥ�UW>붏����@��+ڿ��L�5��5n��Y� v���_Ǥ�"���B V�X@����9���1�4��W��NL�07�]�rܧ��~��zĘ�R�ΜwL��L�3đ�d5�1DI|Z��14^,~���AZ�)|�"��'��5~��~��$]Lq�44�T�a+u����`θ�k-ɚ�=��K�{+ ��F~u��Y3�e����rP�N�V��[ꚠm:��7��k��@���b���o�$E�@��k����MK{Q�} ��(d�����ӧ�*����/�ZZP8Z�������Yw�-�'����?]��Z�R͑�#�E��?v͆I}_�:4� ��I{�3n�<��}���FC�~��h��_M�P2YY����/Z�j����M�e����d, *O��hC��3�N>���B�/�Q0�%� v�����/����;��J����ռ�xf�q4o�����S�m������2Ca�1�d��I���YB�?!T�4�����L�J�˟IfbSw�2N����r��[���H6�I�Y}F_E�W{����Ug�f�Mx݈����2�8KCP������ ��]�n����+ԁ>��5B5 ���*��@����Ws���1��Hj0c�4�����.O���>���vG�C�(���v]��5� ��(x�HqJY�m����|'H�c0g�EW��e3v�6V�W������Gΐ���S��G�G�A��ݽf�`�hmi���5St*^,�,�nH���Pk�5#N<����>�����"�`g�I�Y�cV�� �ٲ�-��'!&����g%���Gpy��c����绩<j�������������F��;�y�8�ޏx�JK�,�h�����r ������O��<;�p��ޮ�s�BH t==U]Ч34�/��f�� �|_�E�0@3q5Y�>Y.N��6s�s zF)h���6[�jy�����Q�շ{�r}�ĭ@
Static task
static1
Behavioral task
behavioral1
Sample
Riotclient.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Riotclient.exe
Resource
win10v2004-20231215-en
General
-
Target
Riotclient.exe
-
Size
18.6MB
-
MD5
e6473ba6914ff2f7825f4cd48c4e24af
-
SHA1
eab3af1e42f803e3ab85dac8d5bd1d1987817612
-
SHA256
f3f190f793582a6a3ade278fec1f639e2eeb82e67251d8768364764e720e735c
-
SHA512
3b211c37091ca15736112176d4fd7841134c11dcd039db5b9ca186b91d8d21ed4efdeaed6b3112e1ea6b29e32f9c9e68307f28efe7133f726ce28693d3d71eb7
-
SSDEEP
393216:WqofGwX3YmdAY2Kt6NYIEMnPe397CcNkQlfKXKURGJ5h8lrX+W:CG1Y2KkN0NNka4cUlr3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Riotclient.exe
Files
-
Riotclient.exe.exe windows:6 windows x64 arch:x64
c7d5e684c95f2aedaeabeae931b9e84a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
LeaveCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 16.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 18.6MB - Virtual size: 18.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 917B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ