d)|�4�&-;5h����ce,���.2���A����1BcҐ�`����.cGl)W3t��$�ə�^8 c£���x�!4��u-�EZ����UjV�XS�뭐=��NZ˝F~�n2k�^�����u ��s��)���x��ۣ�tJIe)�����pL���bcvC.��dp�Q�1���'W��8k������Xl���a�,#�݄:�>[�ʵ|����t��k��h|�#��)��#���^4��dKv�A+V�]�UE|����|�|��Z��t5��/7^#�]L�/�2�5�JzW1p(K� Y��W˻�ܥ�~��vn-&�b>�'�[�Ɔ��Z9����q�!�o}��0�iI���������)W'H{�z:��f��@��%T���D�����@OV��g��*-G�k�"��PT $�� s��F*~�}�=#�*��������'2i�����V`�{����^��p#C{�JXD#-�B�Yi�e���Ƈj�����O�V?S����,0�F��q�v-��vv�`��T:��ϝ_���O�� mIS�߲��F��+���\$:��<��@%|�}F�:_�U��dܿ�M��r���M�N�[�2��S�fM�S(H���n�n�!O��g�a�lgJ�ݫ�k�~2"6��~8����G�,ĸ܊)�3������`�1Pĉ˒��p��[���P#�sݵ8� �+�a��$��)���c������{o�NB��H��� 8�S��� a��,]o��BGVʹuF�]��R{3��qm��k���Տo7=�ڍ2C&�W&��jgy̗�z��{<���Ì:t�f�:��pG�9������ڬ���'�m����a9������s�������[���[2��o�v���+Q�S١2 S��H�S���xaN��͔N�)�=3Ի�(�~"��Wڇ�;Aa�-��fY���/�=Ά��셓���_�؊45K�,��%���{)�A�7|] ��d�I1��I�N���'�0{H_��j�����>�C4{��3t0#��~��~v�W����?�/%wĩrI�H)��29M���$j�4���4dÁ�Z��\d��J٘]uH�V�T߁�����|6Y�^V�{�s� v�}���#h�6>Wu�9��>�J��g����bBdͨ�/��фͮ�Ѿ~���th����L�U4��AÝ=(W�I�`��V��s���q��_Ǵ+U���vҸ�g{&6i���a�+�|��a�U}�谠w��$�ZW��ѝج�g}Ǎ���s��5���'��v���"�Se�ٷ���>�R�_A�t'�i�QƟ��R�z��f���W��Kvm���uQ]��@�s��eS�Nc���r�J�`��Q��n W$&���Ja�����"� ��#�Wq3��d �U�ͧ���^\g��L[/z��͓6��7��m}Y.v~��^��nƬ �C ��)���[��������B����h�V��+H����� ���\�I�?K?���:1��X���� m�E-wS���P��\�ꈟ-b��s�>�GNO�^W7�pe�8x]8q���3=�,m�0�JI]����f��[��E;9����/�>�w),E�B��X�b�疟�-��R��b��]�:wS���3�\����f�Jq�[:�O� S�$s�84�Ĉ.��e���[�Q���!�s bX�?-��XS�y߄?��(����u��x�Qm�;�ff(�A����m�S�ȼ��,>�s���W�s����~�(��<�=�X�0k�Iy�0�a��{m�ڱ����A\��O�n����g'�[2Q.A=�J��9']b���U���8S�wO3���y��ki�`Ê&hl�ڀ��#7�͊=?<��" ����K'�E��F��>�Ǯ�P���A}1ʰ���V�S�k�{�m:�&��&(��p�W��ا8H��^z��c���1�Uc�e��8c����J4�r ���ek��:��Q�;�O�+@�g����W����9 ���&�cx����/�t����;5x��lV;gWU/-��@8�C����q�k!�]��_����:A�q;G|Ȉ��*1{������������^HT~̒��e����4FȄ2��8��j�5�� K�Nv�Y��q�~�칓��Z���s��M��LcX����x�� AHř�8o�T��f65`�EА��nD���cˌ̀U܆;�E�5g�j,���Sy0]��D�X�=�Am��u��+庛L�^io���i����n_Ҥ�X���J��"�vyZ&5X㐋�4����+�Y.+H_�?�t��o��q5�� ��� ��A�%�x�����6؞�uzd[���k#�@~�s�÷x�k�+�� c������ �h2��������$H�d������t�O jC����Hl8��n#��}3���c���Y�J/�Ym�����$�����;����f�����-趘�4��B��Y��ρ��w���"2�i��H����"�:C�����v�&�Յ���ތ��j0�Ϋ���>��'����u~��V��:��i��d,�u�(ѳ�D�"�R�#�w�mqH>���'6RK/�q�.i�����w�["�ھy��x?`����ߖB5��섵�����^���>�5K8ɦCX���\Y~�ƀ ���(���6i-�,��*V�����V�� �"̃�P�R�b�����c]�nC�����������U��mf�#�i>�P� i�nkI�=����H��^Σ��9���HJ���S�-����aL"{фdW���?�39�������<�4����.IvA1�g�Oa"����T�Y���Y)K��Y���6�?��`4�W&�k3�12s��L�7&;f:AJ���J03�4����5�t�@={� 1 ���/ک�[�Z���&��eV������ەW�0Ƨ�}^�m6+ �6{����b� (��C�k��y$R�rɇ���`�q6@���R �C����&�|�W�N�"��4��7���@����J��=���G��
Static task
static1
Behavioral task
behavioral1
Sample
CS2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
CS2.exe
Resource
win11-20240221-en
General
-
Target
CS2.exe
-
Size
6.8MB
-
MD5
9a0a0a8292ccceabe98b3333d8240a4c
-
SHA1
223036b9a2b1417a07e2f4a6e34a10aeab34791b
-
SHA256
ab8be98d57875c88eca2dc1fa0ee6a8155629801ee57dabdd95e99f5049fe717
-
SHA512
175b022677dd3a35e525f182e9589b55e97c39011017adfa9247495baf8206e706902d6aeef35695e5c26fd06e81b27859acaeb19e74f05cc141c912eb82b63e
-
SSDEEP
98304:cwVaclhu+aLQOawY6OlnU2rAv491nZMOSMOMom9efaqyKMS09rFLzUG9Ie:cWl3aPWNec11SMOMotf0K0PTC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CS2.exe
Files
-
CS2.exe.exe windows:6 windows x64 arch:x64
7fee001b6d3a022d0c0baef4c9918df4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
DeleteDC
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
oleaut32
VariantClear
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
psapi
GetModuleInformation
ntdll
RtlCaptureContext
wininet
InternetOpenUrlA
ws2_32
sendto
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertAddCertificateContextToStore
rpcrt4
UuidToStringA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtoull
Exports
Exports
Sections
.text Size: - Virtual size: 631KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.|*F Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.'Vr Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`[' Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ