(�����8&�)�lר�r����4L�rH�%�Y��ID�3"�-x|A���@��;*�`������߂9�4�̉ �4�m�uA�aS8����[���V���G�63�ݐ�ӥ�Y�q3���Qhg���g"d��%�Irv$�VW��A�Q, ~������;�@927AI���+�hc��Wk�L��RBӨ�$h��a�#��&�;�/� ��d/-�V������dp�* �xa$������>pqޜ� �l�!n{\*+�2�2c�֢M�E�^��lJ�lT�2������l �A�a�wu��B^?�� ��Yw�)���M��:�%:g:K:�����8E9�rS����3SR�A�[5�D(^i[l"�������|2�O�@N/�1���5��a<��u�G��� ϔ�E|��'�wy+_D0~��L�N�`�_K����cK\e��OK ^�!j��A��,�^���/o�{�x�����oǛ����v����f���m�^�����'��%���D[+&/Ό�K����B&�b9� EAI�g��-�j�ρ��?�7���Ǫ�u���u�ˀ��ܙ]FO}�����D���̕�Cd�O����ֽ%Q�t5�� M7�ʟa���h;S���̹�ҫ���������!�g���Tې�Yxh;v -$���vN���kr�u�F�}i���!-��n�l�P��f5j��!Y���2�����e����(�g�W�= ;���]��=Q5�Ґ��uZ��0�%%�Н���j�s��^�y�l[�}����L<|+����s�w���Q�N���3�Ud��5X���>�-�!�~`�����!Or�"&2 �k�X!ɉ��8Zt���:��It���!��e?0o�{��~���ͽg� ��1�4�$���X�J�n�N>a?1Z�/��,����D�*�ѡ��D�;�������. ���t�b�I�m�z`�"���%�^wN �D%�ǖjȗH}�8ՋWπ]��_ #�\�C!����\�Ɇ�w�����I�H�w���/�������I�����#�EE���!<���ǖ���/kj��8��e>�YZ;�'Zr�Ja�21���I�u�ב`����-'[�;�<���a�'( �*���4��:����Ez�h��J��@���6F�7B�W�U.d�P�r�#��^>-����h0AK](RT*�L����%j��0�{d��sq,��=�(��$�M��İw��� ~����)�DTk確��f�� �:��zX�ka�b[9@��U*�^�ON�H��=�):Z`��� xw��(��0�6��zYF�Y�TTR�����C��+%w��䞡��{��M|/��\�"��':�+�k����e��"�3���I���z��x4�}r����L<JCD�p�0 8�=aʝ��'0��$�&A�!����h�[n����2�� =D�Z��̦���e��pw3�%���H=:.G��Ka��\H.�3�H� ��:bG�����x�@��PZ*���a�1Dp݈�L2�oLC�^ݸ�:6�P�?� I���0�q`�y�#���8LbO�e*6#�������dn�h�� ��Uf�lM�,�9x&���*�581�$�9G˾���A�����f�K�E=g��m��l'u���g���P�&�I���i�� '�G�{�?5�f��0�l7��ǜ�c����t�c����l2��ޔZ�(PE#Ƕ�pS�WsYu]:=|0=���(''�#<�:Ue�M̫ԥ&�u�^,�[��� �����*����� n�m���g��RF����jcz���g��\���:�~I/<�K���-�!O���@&'RTېk.">��k����f!)<̲�e�x�V��WB� ���!d�r�sŃ��B���� ���㑗���]�5�C1�=љ�%���Y��-��kE�6�Ϫ��P�zt=�(�mF����|�N����Gy�)��ޖ��$���5u�ϪDe;B����sD��߃���i�1���Sי?H��%�����+��i'�4xv�Ӵ�o�lt����X�$މ+'�!3���+��1��hkU�j8o*`��]a�cS�K��#`���j�}�yP�7��6s��$�BC��ث��+@�"��+ �߲VO��{N ZO.@�Y%�H)N�W<�����aT.���BJY����rY�U�m�7MVF���Kiz�����7d�$s��xrW\j��^5~-�#`����X�[P?����3ISH�ٶP���;��d!b��I���Ǐ�}� ��q ��4��&���鋮�V���k}�M����<,����)A7[��#���3E:�Qm����c�tΣh�\����T��S��g�~m��[�B#a�S⊠ZuR���~�aw� C�(�N��v�Pˬ�-��Y}�W�䆷G8-5�߀DO%2+�.�TY��_a\z|���-�ʨ�<���T>����Oigc8*�Ҝ���$�ٶ@XpLY�Qb�?W��?�:b>�Կajc!��:�%�C-~7�5/�\w|� ��Q��zAm����G�0D�����%`��IB�0Y־������$ /.�ꏰ�u}�`�n���z��#?�S��0RJ�0߮�[������/�*�c��47��yb#<���C����U~,Q���� ��,��N���y��P/��/?]��4$��i]TG=9��>0�q��]1�R�u�����o���wI�p�L=�'�s3�I�!��҄$yɦ��J�����H�P�;/:Q2�U���YL+��NT��W��V5+a5Tv\"�,����:�K?+k���@/c�̬�Vs�~��'���5�)��Dd�� �� �#� � u�[C;��`X 5���-) J��2/���ď� A6���rNס,C#�>��+̏��p(妮Z_�!�� ������ դ�_^j��2)m�{��֣K�V�a�պ�fJ���5TN������ ĵ���b�[�E_��=�� m�]ǐW6�>��[��$ �U�C���R�z���tܧ]L� hɤ�� ��p!�urazK�����%Џ�{
Behavioral task
behavioral1
Sample
cidia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cidia.exe
Resource
win10v2004-20240226-en
General
-
Target
cidia.exe
-
Size
9.3MB
-
MD5
0bb1ac0344d05b2c91466370a8614649
-
SHA1
37551585f8324d2ae2184022df5ccea3e29155bd
-
SHA256
6e1924865a098a4e6e556f724b4d0f2843c2b2de2f6e0597a007f8da1df5d5d3
-
SHA512
42bd56ed6b2ed993cc9dedb0732ec650c0e4e7b166c362bfd85d43598c462736247876ec8d26ef5eb14593981b058cbe23c283e874382b93ece94dd2a66a545d
-
SSDEEP
196608:2HokJytQIYL62Q5T5vyXPiLTew2tnDF9TUz/L4Iv7T:2IkyQIy1Q5VvOPUT2nnTYv7T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cidia.exe
Files
-
cidia.exe.exe windows:6 windows x64 arch:x64
0cd5f219e5885deb510805a722b8bade
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
SHGetFolderPathA
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
getsockopt
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 616KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ