Behavioral task
behavioral1
Sample
328-55-0x0000000001200000-0x0000000001A52000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
328-55-0x0000000001200000-0x0000000001A52000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
328-55-0x0000000001200000-0x0000000001A52000-memory.dmp
-
Size
8.3MB
-
MD5
c8153094767caa8b1ebdd7d9806891bd
-
SHA1
5d541c8ac6ed361a54ce40dc6738197970dedb9d
-
SHA256
b8db31b46795b3deddd26babbef8553a4030921a0092c0577e8b23d02e27d45b
-
SHA512
e31160d7faeb8c7de93d81c547f0352ed0a1d25768d341c1dac73a09afb6150d39104f3a897081945827e60a801aff2114670ccd344488e9351c0fe2595d5c27
-
SSDEEP
98304:thdvvtSdd0zlR0AxzQi5C6//u+TDIPGjiIKwLDrG9kG9bHpNSFw+WEoNCdkkBQE2:y6//pqGjLKEUB5vswTN0BTy
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 328-55-0x0000000001200000-0x0000000001A52000-memory.dmp
Files
-
328-55-0x0000000001200000-0x0000000001A52000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 543KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 76KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ