�8;�p^����x��Lr��4����&?���Q&F�aT��Wi�Q~�6b�F0�b��f��H%S�иY����d�V2�5���M��L�g�_j�f�ss4.d��� � }S/��������Tu�$h��;�`Z���@�Y{�K��]o�?3�Tk�R�e�N(����MZ�4��^&<t\�^�J���T� C/l_�o�[����`L���4��A�V0�s[�@�`���V?u��?0��LJ��VM��," ��&MZ��|��+P�" �k�K���n�;!`QB�b �)�XJ���he}�]�sA���=�fAj]���y9�S4�K�ݲ��u"%t\_�¸Hd"N� $�=�m��\�)d <�VY����@fq����Vyhl���,]�pK]�B�+��i��v�<�t��t�R�S+������9U5Z7��� �^*������EA2s�\�}Y^��֖�ځDŽ�_��N�:A�38Qcޮ81�f:MeH$�N��]J��8Y}u����y.!��;է�w�j��g�@�!�*U�Z�)�ΈѺo�=<��$ �C�A q�\�2�<��dO�2p��X�;!��cW~U��m��o0 �x�/������-\i�� z�����gF����J��2rGD;7Vf���& �@k����\����dخ�!Ʌ�)�� ���*T��hB��o�9�|$��A����̑�~�g։H�\�Xa,�<bkˠƓ��8�D#P��O՞^��������80���3���ҩo�����\)D��oeu<�07&ϭ�u:f��TU/()�]�R��"�t\C�!�Ȳ����;�_$�����[S�. U &�R�� �A-�"h(>����+����Xb$H/�34a UU���VԳ��Iw����b�ښk�~� D;V�1�ki������da��_�&�4F��dA�cͺQ�W�B'���c��ؠ��zR�gq2{�ԥNо�*̠MDPa7�*�]�[V��W)}"2�K�f/?�?DV]|�1;�"�MH�V0�Km�?��#�ìW�t��K%��y$�2a~B���RZ����q��c�Z�iםɑYYc���~t��=KZ�U G�i�~���>�8�x�VDR[>�7��� �#]K�L���4�Pc���:�-P�3fqD��%���(�i�c�S%��` �[g]�L�����qM�}�F*Ȥ�^�D�`+� �>\����?����j~��>:�֏��>�W�e%Є��ݫK�B��ks���-��lZ���,�TB��SM����t�����Ff�FaH��kvŏB��&�V��b�D��s�,V �NV��|�gʶ�U�qr��wj��Q�}ˤ�Y*uG�L S�U�ZH���#�Jg��ը�0�>��|��9i�1l~'J�9�8��6�(�[���uF��?g���� -R���p����KgJy6p@-����I�lp�����??�5J��I��h���b�{�n)L�]�w�X�֬�'�א/@>D��� ���5*���KF\����p��ϫ�h!�4�z�~h���`��FJ�'������R4�0���4��K�A��J4j�!�8�G�ړ� ��O<%S$��vv�� ��hI�ދ�xD�V��`wmidJ���t����ӞM:�~�@�Z*n�����P;fzA�r?�? �/�G���{k�������Jc�N54���D-�g���B����o��|9W��i)����P������I�6�=TwZP�����W���Y��ն���N�1�����{��m3- 5��I���0�+��Z|-�z���m�A����=���gXJ �q�A�L��1+ �2��V���'����!�N�rAd�E�6�c; 0u���*A��(.E�-�#�v�1ǃ\�h ���i �Hc/������g&�\���G��ļՑ���Ӓ��.�8M�>s������1Awm��x�/����� �T�D�5�h�*�'k��ǵ�+�K�P=5�t������+��폳��4_�N"ͺ+�<Q�jcO"K�%�ɧAF@��[�Y� B\�z4��}��q�C��H<Z�h��!��p'���=.��q6��L���[��LQ)���d�� &(<���#�fiq.|��RYM`��+hZH1���ዯ�(�1��LJ�DxW$'��`�c ���_�z����X`E^M�.�`�z�K�C��yLkZ9��:u��U�t�`(~��|�3��0;���\���&������ٕ�/�M��cO��U�&S������тD=������ ��Q�茑�9�Tcd�������O���_�8��~5p���,� K���+���ٯH߰���� ��qv�5�E��/^5���t�����h=옵�j )\z;g��"e�*�?x�S�j�P�S��;e�UfD��Z�� �r���j�T������ 1���������@N����Y��Hk^�B�w�&+R�yˀ'F�� �X��B� ����ϳ*��u˩�y���g���6Q�:�?!Z��"���0p�����v����ۍ��G�4Aߥ�a��s=j�?t�� c[�϶2YR A�J+��ԸM�n�O��a/�f;����^u#f녟'4o���Bq�"���l�!���a�f(^�ęc������X��#De� �7�J2�?�H۱_�K�;ȷ�\�L�ݍ4Neߨc9�= �7�� H[p�rA��W[}A"A�P ��N��a@%!f����\#33���wR?�6��z"��M�I�Au�@�..jߟý,ş��O���].>!��ʇ�c]��LM�췑�� �g v9�u'�cD�&#)��f4�,kGJ���{Gh��T���aô+g�fbg�C \�V,Ğ>��٭����:�>��UIi�<yF_�<Dt ���mMl���j|�4U���j��'���njG��?y�GL4����.�����v�R����]f)�jt���ɣ����RƠa!�аP@�ĜO��p��7��,%C�C���'���*E��/yd1$
Static task
static1
Behavioral task
behavioral1
Sample
Insydium ID.exe
Resource
win10-20240404-en
General
-
Target
Insydium ID.exe
-
Size
7.5MB
-
MD5
5a7a0c2c7254d985259cd0daddfa47f4
-
SHA1
73e8767c131ac35cee42165a3a61c0e84c1fcd64
-
SHA256
5dfd3c128ec0044f137b34e0d1a28d084798d1a2dd03f9f9b2e4f79394633042
-
SHA512
fbb92479396d3b42e6b3f4f5b66197c3a12c2d8dc4649ca36061ee3c005c9013265d2b7c828d8ca9e4495ebab62af4e7fa19b90b811021335455b637729bf00d
-
SSDEEP
196608:2DxAqKUDx1Dj/8WDxZhFTBA3lAN1MSrq9IeiUslh627huP:2HlN1H/8Cyo+ykIeivhuP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Insydium ID.exe
Files
-
Insydium ID.exe.exe windows:6 windows x64 arch:x64
Password: unknown
c8033420de3b572310ccccff03a81ccc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
EnumDisplayDevicesA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegEnumKeyExW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
kernel32
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ka0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ka1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 423KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ