2�}߹��'?k|�E�<aѝ�?�� �dl�+�c�$��i����W���餀8�Z�K$iW�5�?���L�n���n�*M��J�81�^��+�֓P���}��o��U�F�'iLY��� �_��kG1?~�����+�hT�n��s�l��ӑ��6�RGW���ڧ\���q��Zb�;����J9�à~vNx�U/qQ��"@3����>�|c�X�VGU�c���"������"��Ћsq����|����)��6�Ü�Hk ��r�ˎ���fᣉ\uT\*����@L]/~�9��l�C\e�n��9���]/���Ǵn�p�1<J!���;{�L��������H*���9�^�(,�:���r�Đt���/��b���<j��IM�������:���G����DO�V6�]�k���h?d���v��S�a�D<Ҏ� Y0��G�>�ǃ�������_8 �@��9��t�I?۟��a�������R����E9������z�}ٓޱ��Z��+��r%HI\ yQ�C����bWE��O��K;r�Þ~��=��|<�bn���9���Mi)����8JY&'@_��]�d?Pu��r��J&,�ҋ���� �����Z�i�pQ��r��)=���!#�M���4h0����±���d��[kt2��O�:��L�_B��:o�{:T����R0����/�M&��!$f��O=<�&��@�Ꙭ����98�戨b 5�0���Kڮ�E��菃m�<ȶ�W�ո���C�R�&�D�,=����f*�;eG>0�3�X&;2� �`��o�p������D��bm��^��q�>l>�9ǒ8�/7z�������.x'�!��4�ȺG���4��K��� ���F(�u,�a�DB�m��6�&T1���E��Kv�9U��&�����y��^�跘xQ�A��Ӆ�܋��^�ȴm�3����q�5����Hm��c�#��0N�(��aY���5 ��~��4qB����yy����mN��eL�P�Φ�{��(������~�������m����|�Ȗ��F��y�ʒ>��aТ5��=�N��[�V����e��9;�9<�i(j������أ��ٕW�9�ks��6 ̴ü�'-�&�(X����G)�X���;�� _`��O�Ob}�U4�Q�ǁ��s2LHw�JxZ��,_�����n����2�K�]LBI�e�%S�������x�M���~-� �5'2��s��]�;.K4MW�x̭㕤���w������^*L4,�4�&��;�%}r��)M\�%����Ѭ���X���_�~s���¹�]L�ъ<p��������~e���S�������g��w0'�cd��Ru� �1��U��F4�I�Y�&��NؘAȶ�ꪯ�b���z%O�����j�Y�r�Y��Ud�(��D�lr�Ŋ�^Q�o��#��K����]��75�,gz�J�|;�o���쏙�w�ɹ��-�(Y������b�l�y�� �:����Xs�b�6��ԃ:��z�/7�%�n���o�'�|�tH��E��䐀���&ʠ���{ į\�r��0��Y#�U� �{���H��x�?��ԝ�,�o.a��R����ے����7��~���a�ѫ �]��i��*Vr��L��-RZ���v �J�?�e֍��$PF7��S)��/�Q��'}!@�i� ����t�ϸ$>�KX�Y��?9�����e�/�*�.:"TU@XZ:f���[⨳�nY�Տ�!4h���7ZbB�?��P.EƤ�z̤P�4�~���dz���ђk��i�E�����������[�.���\^����:���% {��)�r��<�<�|ڠ�����TW���#�ζ2ؽa�iW���-�I8�B'�q�p�q=��X�kOT��ھG$��zWٿ]��a2|�ċ�Q+�r�g۰���[!�`�1� Ӆ����[�r��־D�;� s�h������kZ�Ѓp��*$W.��__��Tp�RV'����LLݔ��a��#�d�݇��t�49(V��NO��2��"#]8�r��e��VK�gF;!�=m��l��bs����d���!^�E�J�HU�M�3s�E�$�s��`�Y�0�ݻ]��Ww{��G�]�Y��qH8r47<w27H#�r��j�m�� ����@3ό2S��0���䚝������a �Lr����|0H�? p��D.ʚd��X�O䒄������qV�*L��5x���͡�$�� ��C��Ü�CO���gpU��ߐ�:��" is(Q��QV��XãLDY]���N4�N�$$���q����̜�(b�LQ8l��C!�";sOC�wUt[�纬�{��'vɤ��j��-q��o���U���[�f� w+��AIK�����8�:"��-�/���!������#��$�N>Z���E��{=�wx� `�a�J{nBEqGѨ�����#�u��^>��_� ��;�/��a�����1����q�++X�\��s}��ܩW?���0����q���Cb�����Ԓ�����0|F�8�3J��PR2V��VpV�.�bM��0�`I;I�2��Lj��v3�St�<�ى}ؖڛэ'��"�u�����4f�t�(]~���$%�JeS�g����ˣ���;�ń���&Q�����N�ڕ�d<�2��q��F��$x�X�L�U����MS��q$�� c~�Y$������O����h |�H��p!]I�)�l��)j{�9�LJ�{��f3�/ç�� �7�z0i���k��;� ���;�˛K��]A:�] o��7/�ԡ=!�DM�;�?FU�nH2myl�0��S��y�?� }ݐ�~ˮK���E��J����?�"E܆�;�b��CWO��;4LsiK�aN���'��`�3��w�q'+����O�K�ΩY�� 8����0�-�|���vt����*5���ۦ^'�@E8r}n+W�.��+蝄7EM�l�� 2�}|R�6Q���n�>�y4���է�]|�a�zJ�����47�Л�����
Static task
static1
Behavioral task
behavioral1
Sample
Awaken.exe
Resource
win10v2004-20231215-en
General
-
Target
Awaken.exe
-
Size
5.6MB
-
MD5
62544417f969df0a0968cfe1ca4543ab
-
SHA1
628e89997381e10eceeb62f1ef711c985b372804
-
SHA256
2eaf3b90e11c814ebfd1b84b471b73d0fd4e5d3695ef0d92006f526d3397a067
-
SHA512
583c4aab3a84ded6f223a74751d86e6b3b35d39d2267ef78ac4b030139b17c40e90340bda299021dc0cdd536cf2b6ae5625648286223c522917cc1d1c4b9d12f
-
SSDEEP
98304:Ll6CUAtXnBfAo1llKgU8+Da5WWeBdylezG5kRVLwL3On0f2rWHbS7d:Llp1nKktX5WWeBdu56VN0f2rcSx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Awaken.exe
Files
-
Awaken.exe.exe windows:6 windows x64 arch:x64
7af8e42eae971ad4a1a555927295d8ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AcquireSRWLockExclusive
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AddAccessAllowedAce
shell32
ShellExecuteA
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
ws2_32
WSACleanup
userenv
UnloadUserProfile
crypt32
CertAddCertificateContextToStore
wldap32
ord301
normaliz
IdnToAscii
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: - Virtual size: 140B
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rtrd0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rtrd1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ