,d+���x��?���YiV$\i�b��ڢ�����!Y՜b��i�d$Z�x���K�i�oY:J�{����h�� ����F�O���oH��~�du��w���3NE��Iv�� �5�Q������!����%��_��ʯB���h�� �9����C��Z$�ܫn�up��7��ZU�P�=]~��Ϫ�:&�\�*���zZ��Uъʹ�V�D}&���������qBz�M�I�(��1�|6<�tm��I$���`F��K���\W� �V3�������h�R+ q1�r��I�H�&���h!E_�M�a����${����h]�^�����Q��?:�H.��gz�j��]�l���P#e��v,Qu���V3�7t#��u^�. �6��T��B�ֲ́�i��0�D`��X�Z�O䁴� �*œ8:"S���ۼ��(P.�c�_�b�X�� K��M[t����������SA^��k�0Jf��5~X��-ܙ8u�� IJ>��ZT�N��A&�>�m�p��q�-S��wO:�Ϟ34˴���dfKx�߿.<9�ɱ�|����:�ȳ��x�W��-�(��q�9S27�X��܂�7~M���S�*H�A�s�W�� D�e|�vn���&�&3�wr�A�n�Wna|�4��_�!�"mz��g��I���䕚���S��/+6&*��S���og����2$V���0�}@n����痄��X�����0?<�v���~.p��bIa�K/O'a[a��ӟˀ�*�Ȝ�q)�~ ���'_�&�Dۛk58���c=�%)Ѵ0K-��0�`7�O���g�q v�� �� ~�M�=��9��gwrY� ���-Y��-���#Y�7T���E�t&�M"�~�fM[�˸P��Bx{���C���<K��pӟkY/J�<7'j�`h��~��X�"�� �Z,\�L5�����J�Unm���qq�:��\�Y#��:�tg�a66���q����p���A) -���d��X8ϧ�9�Gg�}ިx/���R����X@��k/��[hѷw"66�o�"sp�ӈ�/h�֪䤦��N�Q�:Ԓ���m�����l`q҆�Ʀ���O�Ev�����A��ػiv�>v���UI�zm��y�� F��AHb�t�������X�1~49u`�!��}�'���55� �w� �,��/,�����n�F�D9(*U*�7���.�;RX��b� �ޮ/��S�{�!:Bsj�����L��c}UC���ig" ���Y\A�[$���е�H�H�NW��ET��}�^�>�Ş��� ���T��������\2��*��qT�8�~���(|-� H�lr%����49���2C��1hɃ��s��'�\��9X?:�1�8I��5@)2^���z�E��-�`AB���=�� ��S_���-�B��e��U��s��>�HQ�j ��\���]�s�<isG��.��z�s��U�E܄r�u�7��G�$���l��p�SZ����]�z<�(~D���b-�T����.T?��S9�jw_Q:]L[&}3m��r����Y%hXF�1NĦ�gZS��W��C�=���s>N˗��(I��U�+nF�I����9R�������Y3\��fƈW����e4����X�Gf�UQ�C� F�iZY���]��?#t�~�T��mAA3j6�eK�����܋�9��c��@���U�7�"@���.+nt4e�+eGw�x�8�"v"2�h�� )�w[�ܐ+k�<���[�^P��t�<�n[���F�� 1��0ϵk(O"�����C�X��g ��8�[v~���S�X��[�@'����\kY���V�1D"��]��2��e6,O]��է�1~}�>���;��ј�x�ph�D�x��hAZ�l���`�i�^mρ|Ph}l��*H$�[4��]�蔚i4K�ӟG&�`"v^�}k�Å�Zn�wIBc�^�="�+o����_��@w�Z�����X$9<��\��{tt肐�}���=f��[���h�#��$oy�<��-Ʉ�n"E�3~�*|-=�?��p9{25����at*z@]�d�����Ӵ��D�W���!/z���q�� ��)n�-e�P�6���̓sG�sT���~f�S$����-�� {�1�t0K�iLX�rvU��11�����y�Q�eٍ�3J������e@�ǩ�>7rUOr���r�s9�����x���08M��3W"��^�ԩ�mCL�bd��P��ڛ��ą������KZ�h���`�m\F����cR�#�8�&�8�n\�4A��%Z��z��L�g��K�X�����ų�� ����4=���6D���`%<���(6'��et���L��o� #�C�vPu�H�L튵ut����.�v�o"�깦��#�N�eڠ~KJs`~#e� �J�Z��5"2u4Tlu6�s����)�WG58��맸��˘���}�=�Q-���������W����4�J��|�s"@~���Ey�@��v��yؙ�)�+�0��mt�7�-h[�p�'��7��j ���J�o?Y��Ǝg��N������O ]�vu�?r�v^{r��K��]�6k%��0!x���>ýi����b�L��D-�bD��h_5Z#��1��{T%zc���h�R!f�G��ϐ7b:N�e{�uU8��}�5$�@�x�u P�eY���ل��U��s��//^}0�K�=�t����<t�D��:'�)�iW����������*����a�[9�im��A����wq �51��N0���rD�^<qB��D�4b"_j*������Ϻ0-�8=��I3�5ٕ7��%�YcDlpf������%��f�Y�0�8�ʹ�b����D}����kv$�[ �AZ_�t����n.�Ǩ�뽅� �j�9B�{��=�3�囙��pm�FH�"���5XeH;b.����v�̼�d��K#ӱ�QR��x5���sx��V�Yu}���!���X �8P�h��ԧB�F(�Af(�����4�X6U��piz,��n�"e�.H��ʘ$vW
Behavioral task
behavioral1
Sample
naYsT4gbkM.exe
Resource
win10v2004-20231215-en
General
-
Target
naYsT4gbkM.exe
-
Size
15.8MB
-
MD5
a9ade7e081a5a3b8f62dd681ca07a83c
-
SHA1
ed973916922376456bd0b96de407d67c4329ed03
-
SHA256
158ff795ae51c187920f6ece6ed89e3ac4f03aa5da4ffab829cee5211e840e72
-
SHA512
38b60b42d8ff9e90c0250548e3b0be83be6e014aac0a7f8dd232fd678d068c106ca59801cde4acf2f3263f008b45f270deede3018831619af1719295cfe51030
-
SSDEEP
393216:1uUUFMqXCLlnWjLABLYHfahU3O/BbPg69wWm2:8Fneu8YHfa2+9PgPWv
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource naYsT4gbkM.exe
Files
-
naYsT4gbkM.exe.exe windows:6 windows x64 arch:x64
fca609be9304c7cdf9b83b83a5acf4e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LocalAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
ntdll
NtQuerySystemInformation
urlmon
URLDownloadToFileA
iphlpapi
IcmpSendEcho
psapi
GetModuleInformation
winmm
timeSetEvent
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertGetNameStringA
ws2_32
socket
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
ceilf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 15.8MB - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ