?{H�l���З�I��HBWŜqv��r'�x�e4#�S-3����R+} �k�Ok%��ۆ�����%<�����Xqc�7�܍/�?Z����;��ʉ�/�2@�E�������.��Pq4dq�2�Q��:�Fill4�@��Y��;��4�2��2����3��=�[O�Ծ���ܼH�+����˹����IE��v��v�㵝�m��}8:�~L���y�:�y�YS���P1 ]���?�oÆ2��&$���-F��j�Y���P� )����?���zS��R�U�.t��s����_��TX�^L���0�ڒ�s&�b5���!?���j�I2ʬH"s;�Ȑ^��%�,�n��1��*aC�r�lF( Bj���aj.����<���"���P���L^�ĀWf�?��(����������$�h�,�<h��G�B�S�Q�}@��b���(2s���+���.�� m �z��Ehf&s >�[1��CJ֕ '�E��e� ���I�����q0nʥdŀ\����Ub���P�����{�;��L���}��4Z��0J~_w&��� ��r�b�^�:yЯ8�4����EV��/�����P�r�A9��B��Ͳ�Ұ}�=|7RA���҂@�� �*N"I� �mS�h�y�?��gv~�z��^�Oq21q($��,e��\O]ͩЏ���1u��b䊙��2�PQ5f��<��U_J���F�\}G<�}����p��S�?���o�����ɅrV���㏲�N��3��Va/������C��1��e&�|�`�@���˳y��Ó��M��@��a>c����e9���m?NjX�e�1&�.q���d��!���)mά)ZЕ;hH�>$i?��F� ����+�U�8js��QZ}�T��S��é��1�iS�=D<��X\�$٫w�WnZptIW�K��;z�9��Z����#6�_�}Nz�v%5�e��D�D`��6��R%���( {A���1���� t��#���5�����mN/�G>��DZ � y�(<[us��ba@%|��f��[,ܲ1Г�w����T��8�TneuM9�G(�:w�J��T��R� �ZJc�i=uS���ψwn�Ua�L�b_�#3�s|��=�D����ʙ��P��>����)�������a�?�"�iȤ2AZ+Vp;�,� �/�����"�6`�A)�3K-�����TU��}NKl�T���,�[wJ1''h?���"��r!�e���_�T~���텦s�R��L�wa�7�(�B(���YL��-�!^H���龷8�à�TA��E_�fb��u~E�[�oɽ���`'��T��o\�� �r$}.�M�`1� .�Ͻ���+ˑ����-22L<�c�>�� #� ��5fbT��Ǻq��Z(�g]��_T�(HL��G�l3@2��.�h���G���/���� U�XER��&\��w 1TY�U�l�ՠ���U�ו[�3�k��;���x�X�|��Nef�V���͵w/��e���n�7*�O7h��^x��r��`#�G� �@�F��*W��������M ]�^H/��X��UMdУ�n�t.��.�Lq�O���cYv<�Ώ��0��<�bw|��o�B�Yk�:�5g &���D� ��+�!��*�$dgɸ��)� ���EK}��x���?��� �R��럕��,����|F���8 ���F�q_=�33%^�Β����A7V�}װ?�b[��0��"��3M���.=���z��Z���I���}��7�����E�YC��oƿg���t�#�[!�+?M}��W!3C��s��K�n�gal�/�J+�dT���F�C��("O٘H��R���*q�G��iu6�W�6yb 1b��q����S�Z��rd�o�mq�ynח]���&�%(};����z���Z�1�'��K�f��-"N�nkd�&�5O��YԬ>��l�$�i [8�'b���"��̓(|ľ��L&��u�� ^`!�ܢ����g�@���O0ϻZRƊ��F���IbN�L�=�xv��\k�ۯ6*���e�X ���-� �1�k���l�`)�X�t��3IIɴ�*%�]����� �N�5�~W��&r4�LD������i9�g�a�M��Z��If IBЁ���2c�G���2� ��1�Cq8{�SEG-&�x�5x��z���Eg�iE��v=���m@"r�"@����r ���^���Ǿ ���K���s�_Ϻ5����}����6�����)�5&)ɞ�f�1���0�����hɛ9�Ŗ�,���K�JVZ+n����q�[��U��:�/S�DD�P�d�x��n4Jn$�>I�OO�mw��P]�J�w!����b��j(���B�K�O�U�SIHk�j ��$v�JxB�R�[���Z��F:�E =�"!���V`�N+ @�D�G�DzX�?�/�r��k�? 9��ZNgK�k�<+���j��Tv��$h��������1u��Y��]����> �u��Ӳ�,l��Zj�K��,}���㩅������G2ϔ ǿ�aݥ�/ �is��k~�AvL<gJ*�>���t�hEY7�w�V��ǜ���@�"d���e�"}�,Kj~�qe}\�n���B��ӘJ5B�>�s��1d;�ɢ�l®ã7� ����E��\k���#2��y���=.-�ʱ�~���\���u�ׅP�#���O0Q&D}8������0�&�*���u���x� �c}�����\(������&Ζ/�����c�(�4'�YmH���=L�A�_� �KZ��g`+�%8b��4b����~;_tNk�e*��c��o�{�B�I���{��c ����q��:D�E@ݚ'��!/�WWJ��)H(����� '9)dԆ�$Aa������mx|�2�τS��1|���Ų�c�ڴ� ��S'���YN����.O+F����.�w@'�Th=��P2SPe2D �T\�U���ʮ�n;z�� T�"Jpv�<�(�hJ�6P�L���Py ķ������w�G70ș�l��ǖ)���hLp��v�s+˛'��+
Behavioral task
behavioral1
Sample
cidia24.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cidia24.exe
Resource
win10v2004-20240704-en
General
-
Target
cidia24.exe
-
Size
9.5MB
-
MD5
272045903db4acf95cd6b24b99cf8ff5
-
SHA1
a4edcdea971d8c634e9329b9151ad3ad1e7c06dd
-
SHA256
3487d1195fbb1e7a0fede4e1836baf725dfe923720ae40eae184bc320034906e
-
SHA512
27a97bf1d9ba3e7315ebd10bac0e389ece41417fe43ccee25565c4ac5ac657b74abef0c44d63f5f48f5ba4cfd62c94ecc9e271f56a1edc0e4848d02762d1d8da
-
SSDEEP
196608:rfk4SINx+BI8YnnR/GxHrxBCa6l3X8hW12dgi/NC5E0eLEbg:rfkr6osR/oeshW12XGeLH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cidia24.exe
Files
-
cidia24.exe.exe windows:6 windows x64 arch:x64
9541d33add34a7888dc85c11ea993e0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
IsValidSid
shell32
ShellExecuteW
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
WSACleanup
userenv
UnloadUserProfile
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 629KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ