j[(..�#���M�]:����Wʬ��7D�5'nf�d�s�ާ��h�?{H�B���'8&��x��2I��y�̑�~�a/�����d���9�v�dZʺ��h��{�\QD����V����og�*�Zf���ݞ���LZ;�Y���~�(]ޟ����F���uՌ/��d2Ή�8%'�z�K���H���*�'�m����vlR��X���K����i���?o���H����3��%kK���Nڇ�l$�RUOMT��w_�.�����B���P������A˚u�B��=�GYo���B��A���PP���$��onp�ғ1����nG�_U��:��<X_�T��el^��IQ27����)�ZZ[�?iuڻlP�p�߆�&7o��9KeS����C�ە��?Y�m�������j���Y-��I>�MD6�X;��t����#�:��j͎FK)��r���:!��V4�%�G��ViY,�����ׁ�K/1Uq�E"���?H!�e:��Qr�/(�k�[������-�2-��L)��s䴽�F%�E��`#��.���O��K\tGBQ��]�.x�(�����gH���Tf�/�߬������Bg^���N��9�]���i]����R1'� A^�kW��o�)��F;�Nn��Q�X��-�d9B�dm�L�I���ɊA��1���8�q����k(j�t [Y�tTٻK�]�tK~�_��[hY�~"�O��3��{W��w�b-�,Q�W���#��U�C�[l�kZW��|�=�Z�r���tu97����Ӵ���:0���G�} l�0���Z���s��$����B����xM&��%!V��*>���P8����d�~$�5*�����VDr��Bh~O����Ń�"ң��pw��m٫\c��O?�q�fF�}�D�:�z���Eh��LAg�b| �w�j�)7����J �=���7�ț����װL��2� KɣM?"���]{�ų��\�?�l�7B�G��Ǒ>#�f&#��$W�E�ow��b��z.�a�ٺ�<�������nD]��J��@K8O��x) �fB^Z&D�1y-�G����ah����t��k���0|.5��~FΠ7v!R���'���6���̓���Dk�@��\�R��M�����Tm���,�3N�PB��?Y� U��WG��]�x�+c�`^�ㅥ�b���@�ݗ7��ً�)��Z>�k��8*���@����y!3bt.�߉��7���@���+���Y$%���ɠ���fȮnӀ�V�?sB�6����,�K�f��V�tLR�sѺ�iJW��?�`�n���U����h���S��M����������8é�\Ѫy!>�8���S��������a���#e&����u]�B5ȁ�%��� +�ko�9Z�:�6u��Q__����ѷ!G&��0���l��뷍>@�{��<'jr�se.��h�34Ee�{1@Q�FP�#/�,(d�G�/3�6�����e5aS�&Y#a��l^�����q�ܒ�@��^�}T��T6���H��G�,A�fIc�ʌ�v�G�ƾY�Ƞ�U�Ò�]�iu��UO�<F>^=��\lW���6�L5hh=����犹`�H ���ކE��5~vG�* YJ�fdKH����R�t��9�e#f�ߠ���|�㬈M�A���-�Oڠ����zt�8(�&��Y��Ə_ �!��,��f���q���V�JAM�z���K`I��ߖ�<��hVl�g��H���g����}�������W�a*js�s�-��8�ļyH�&gz*�I�S�c ��6�Lk8�<������\U���,a8 �� ��ы��p�!��>We�/�Y$��k�E�.ю�(݈��uޓ�b���4�t���0 lH�^�G2�+j¼)��](� >3����e�-:���3d��2%w&���t3��4�J�!+�P�W�M9���]�s�r���/`�<�������,���z�9xj��ow�d~��W^.�a�Q�d{��+!��7E��E����w5\ծ�&`�QlHq.D��wR��(uz�0��$p�M�rAI��9�bJ��s�:$����ө��� �2�^aӢ:�͝��2nM��|�l]ac�1�)�W�[��M:=�����SdK3����E�<�E��Sև�N����3t���Z��6�T��m� ��b�إ���q1ك5�{F��U�� B�ʜ�%�iW�R �%ъ��~Ⱦ�&(H7� ���XM�,XY�=6ۇ����y�P�o���Pl�q��ox�`��cCU� �;�'5���K��b���˽�� d��ն�xA�ӊq�K�qX�l�nJ���ܷt���l���Op�A�%�Th�"�ri���Ҧz2C6C:���p��L���k�3����D��p��ˁ��H+��a'-���C�;���e~�),O�)��b�5^�-�bܵ.l�HQ��<{���c�\d���4��y^>JeS(~T�%Cs����L%�9c c��J[#�t?QpЃ�CQ�s�����h#�~�c�G��B���������"���Rh6��s�7���o�_�@�#��{��V��r�����m*X�(�H��M�B$��C�%�1O�[�uI�c{�q�� ��ITV`��<WS��.� ��" ����՚t�� ��X��'Hq��p>D�YK^��[�=}�,��/;J��H��`a��r}*��uȴ�E#�;���]ɬI�^Y�p��QZ4����(��O�?u��ڍ�s���]_@�L�|���;�"I�b��j�92Q�Ϫa9��dQJ��T�-��y� �~����iQN��x�i�Q_7�ɨb��/���=���O|��Cd�ZOqH�jړ����q����� PT�������;�Wf���f#լ���v,�1���2:'8���_�D7P3��Q�:>��n������(��:بJF�\�P��\,��k�}u�y��"����F����0 ��p�- �ΏsG�?ǕGEo\����1���TF�Bj4���:�'�_�2x��/���h� &�`M#ң��d���M`�J9
Static task
static1
Behavioral task
behavioral1
Sample
Usermode.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Usermode.exe
Resource
win10v2004-20240221-en
General
-
Target
Usermode.exe
-
Size
6.8MB
-
MD5
4edf68c5ffc1105b1d02985ccdfabfae
-
SHA1
4e147dc76318c8997a07a95d710cc25f8d219564
-
SHA256
c74818ec0fdcee4325acee79c84c26791eb10222525cd12ae1f3e8907386cf1f
-
SHA512
be4559d0d4b4dac4eb4c62cf0948ba6967f02853ec57dd544a7e4d553ed74f11791110bdf056c6e65e94bb2af37622da57e245a6b82c63c33250c612a1f3d357
-
SSDEEP
196608:X1LUtmRv0EPNphPjbbzHNuXHyfgnBzS/ongZY0Hd:19/PfhPvbzHoXHO8BOH+0Hd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Usermode.exe
Files
-
Usermode.exe.exe windows:6 windows x64 arch:x64
3a4518fc7b75e5f99b6d0b5ed297f225
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemTimeAsFileTime
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowsHookExA
CharUpperBuffW
advapi32
CryptCreateHash
shell32
ShellExecuteA
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
wininet
InternetOpenA
ntdll
RtlCaptureContext
winhttp
WinHttpReceiveResponse
iphlpapi
GetAdaptersInfo
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertCloseStore
ws2_32
getaddrinfo
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-math-l1-1-0
_dclass
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jXW Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.?@, Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dk2 Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ