�*]�H��V���T�+���ӄo�����+/��WZ6�ʼᕓ�d���C�dD�.7h�ƭܮ�Q]�P��|����Gv��6�'"'�H�G[� ���Z�7�g{5З�/��� �/%��1��vi�HV� {��sobϗ�w����`�"��&F���Ɉ�XQnD0�C,Hy��-��wI)��)����*+���,2�yg�8� �Ęw�{85��B �I��U;�-�<-S{Z���!�ٶ4��*PѺ�{��w�HZv��b�o��`���Zb���u|:V����A��}�Ʃ5� L���ƾvR���4��6���5d���M�t��L�f�-˛P�)��y��axn%��:z7Z��5DȔ���G�lz�÷�4���8Z*U�m�Pu���� W����Z���w��m[*邵c������!,��Wc����Z��A����']ˊTz�s�o���5��e�^��(O)�^d\HlLs�t�"�F����et{+�[3;�O/�as�����,"�b��u�q�>:k������"��P�Dn�ڿ"�(]��R���X��X$U�6��c �Q��pկ��S�R|E�>��(�r���3M�����p������F�u���9��jvM`�yS�و}�(IR��Xt��4�}5�cQ֯���д�����E�x�2[����3�ZS���*��,��E�`�|�c�/2�sz��ʒ����sS�S1"�C(\~�L�a��>K��z��.U�{����*���M�;������@�)ΐ�'9_'�����[� }��z�*�X ���(㑜����E*#�D���dW�6E�el k�ȏ�$pN����̍5�˅V\�3\xZ�L�\m�=��q���bC�����of��� s� l�4!t�x���0=�B�B)�H6_췃��j���}W�h/��Յ3�9���@CZ����mG�}B�8zۓ0^�]:���Z �V��Y]j�Gׁ�ťP_��,m@�7Ey/�9����<���!((������"G�~7#,����d-g��C6ɮ�e/����F�8%ǘ�ѣ�����6�,�X���%@ �Ù�z��o����z�8J�2 FtVDs+o�Sg��Y@�O����4z���ޱ�"j�bW�����E/k-'Y_G� �8P�gX!\�٪h㰳Õ���p��VR�:��ح�~�K��h}��� ����4^wW��t b.2�[�c��Y����3�)v����*+5#\n⎒O���X.s�b?y�3���ӉT2���:�W7��s�N��b�^Q}�Ȗ���ףwL/�9 {1���8?�!� �~E'�͛�@PY�J0�, �ݤ��������y��H!Gt�$�j����zY� dM҅�$S&�^&�|��gd#y��6uBV�����6�I|/������y�tbQE�5�6C����}E�G�h��L�+Xt���"��ˮ�jK!�P�נ��C[+��}n{@�7<K�Di�r�RY�G�ݠ!�q�l�(�x?��v�}&�R'1*��M|���pI�h���-YQ�ќ�t�����l���\����R�Zp��)R�O*�5�၎d`S�F�eފsR��;"�Ñ���[��CTT t��${����,�a���G���*���w��}�+�@��r= �*v��x���]�!W�JxE�9�km���Z�@�FqE�����g]:��E5A����9��1&ޜ��z�)��Ǫc�;N�Yw�e3�`:��+Y�9_&���k�[(ݿ˥�eͯ$��DJ�I/|3���`GM/���{0��� ������g7�~�?����$�{M�}�;����g'.Y��l)���q��.s�<�I�8�Xɞ�g���D�s�l[\�o#���։ �!n?�兗!� J�;����3�nr�ԩ�s��,�Ҡ�\�WOX��<��i���X�S]���Q\��� 3�/j�2�����LD�8aq_8��X9���0��k:]����5v�W � �KԪ� N���;������/�`E���i^������y�z���YP�-Y����xop!���-w��[��{��r �� �yr���4����I��ZХ��y�L���8��%݀��N������gys���!��Γ���ֹ�L1��x��rMȢ����3[Û�Ńek'j�7�XD���K����;+��Z�Iy+�I��0�oZ.������xڎ��[�<��s��P0������WtJ���J��@<f ygB�r8xDϨ/��>Ȣɑ9���[�k]�&M�����4�#�wwZL��tZJ�[�e����)��b(ف���kҍ<� ��Xp&^vm�MdyL)���C�Ey��+a-��b�)O?O3�^��q�Q*���n��5e �*�u?��x(��5�]�IA����pg��,��J����"�h��IT�]�x7q�^���?G�1��jM�&yp��# _��,��r�)i&q`�W�]P�����4 ���މ��� B����1�2W�磓������B��~S�X�հ|����5��ҲR��|S=����w��v�j�!�(���*��ݯ���J�ÀS֤`a�%�f|�+ �*�,�$6��q]���p�7�x�8���&ϭ]�ঙ�ٗ�%2 ܘ`�D��[� �W��m��Oуg���ι���m�xG;�i+�vrd3�2�M����ZQ�a�fu!���t�>ulx�x|@Bb�����b���6hN�X�p�����}���jÚ|/(�V��ʫ|�C���K��1��ã�g�Xρ �[+\N|��;����bZ�a2�����ɏ���7�<��g'>���^с�c�|���>|O��iM&G�X��#� /���?�K��9Sn�Tl%�������#���ۆ�'벿�1�;c=d�{�u�����[R�a��Ϫ]�v{k���j 7�T�Cu��{�d�붓���`�y���O?�� ���s�O�܁��>� RQ�EZ6�_���?T�����9[����p�9"�N�ib!�/B��������w�0���]L���/���}�t���G��-����k
Behavioral task
behavioral1
Sample
$RDSM5EE.exe
Resource
win7-20240708-en
General
-
Target
$RDSM5EE.exe
-
Size
18.9MB
-
MD5
5c34477337dda78c068fc117f63f6eb4
-
SHA1
52e8f8a464fbc93a6913eb48c1950477fdd91fdc
-
SHA256
a5e6afd51c2e629114d5fec6f22bd39c06e55e904d4a145af665125567365d86
-
SHA512
2469fcb26f3ed3f7da6825c7fa2864f5a02b50160dfaeb70771f52b9f796f547f56f568effe5f2974cd5bbee7f8eccba48347360baafc8a17a4cc495ee4d1d5f
-
SSDEEP
393216:U1WR6oh7rNPlxI41aY67teMYokZZEsmNHK1oP8pNkMtYYp:U1Gvx0EaY6WokZZEHioUvIY
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource $RDSM5EE.exe
Files
-
$RDSM5EE.exe.exe windows:6 windows x64 arch:x64
2278a975cb46dc4fce45a94431483414
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3d9
Direct3DCreate9
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
ws2_32
listen
wldap32
ord200
crypt32
CertOpenStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 18.9MB - Virtual size: 18.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ