�����%e��{��$�����n.}��4 ��R���y��Kf[]W���)��eW���~Z����2a�t ��ғ�;���ï�@vk.�u�I��*�`���-uP6H�6K����pe� 3@:�IA�����]�H���a�/�����|�F=I���1_�Ai�>�i,`)�*@{�!�L� ��5��-x��W�d0�LeF�F��Q��Xua��` �,G!X��Bc�426M CK�B�M���}1��%��o�ΰn��� s���2���%�Tπ� ��F���냭x���$�r��UN���ę�%��c����B@����i����^(^R���[��Zq>v������4&��R��9!����[B��訥��ٷ�IFQ����Cq��� U��X�c�ۻ���%ؗj���HY��ͤ�����v��~!�1�ž�CΙ�8�?����<]z �XH������e�,����khp�;�`���\&=���P�u� Q���`kI�r@� ;�������Dm��(����TP'Pg:�� -�}rPz��T�k�8�"�Dn�NIaMM���|�_�L��W"����/�$��jsL�j�[ZG5�a$hu ��}���� �����e�ǀ�V�29�7in ��%��g�����;�Vw���U�m��֗��K2��`��"�I�qn���X>_ųS D�b����[����ȳH� Uƺ��L�P� �"���5��o���Bw[z��٦��vʛ��Ъ�Pou�{��05ښ�1���|o2�:@R-R-B��H |��&���������Vt���9�G�B����T�/C2���� �����Kf���5�tB�+)r� ��J/����<������"�p��O�MK�� �O�Wj�����X�(y�[r<�CP7D�����{�t��j�r<�=���O�LMH�ThOGS;��5�sX���T3����?Q���ċ5�5�����v���6��� ������)]���Ae1t����|[���hJ�����J��L�əGH���᷐���Pt��AM���N��2� R#,�{<�UzT���_\�IGpW�����9R&=�?���,j��5��(�D�5�M�C�RZB�ß������Of� [�p)���&(�XN��'�����R�+���[W(J�ڒ�e�cRM-c�d���������β�:�, �!ժ{_����T̳��Ƽ���J�劲��*5d�"��̧�E�/˛yR2S`�|X�E|L)�X������#���;�����)~ה=2�Q5��m��}�5����=��0Vt79Y��gq����`/���"u�u��L�3��p}���)(#E�$g�&�*�M�v������ө��\��F�5{qvW.� X�D�h�yz`�JZd��`�ީ�U�h����x�M�<X_��a%�\ >wji�%;p[��q��e�"��1�^%�-$Iم�S���3���f�3U;g<W��V�Փ�[��~y5>hY�%wS��X����ۯ�Y���<�������m?_���%]u��5��ZyP��)��`��/\��I��jo��i*�_�q��%g�ңݳ���_̛n|��co���iϝ����|��� '��R�*�d�H2:(�HLӫ m�Mh��Y��g{W�E���:o��R�ܕ�e��N������vBՖ2�m�ퟓ^���s+�OYڇEbd�(7H�+f��:롁z��`���qyN���������,��M��h'�� ���x=/��}�i`�I^��ã���,�Z+�����pM�D�tu��=����%>��c�L"�>b|�N��/<���cha�'oZ/ʗ���4���eޥnS�G�4�{� s٢�[%ߜ��)��˳��qϘ��\�$O�����2S��4�3�ɐ�Y�=ʡ�_����u���0��Oe2qD�Z�`��A�f����rF�^3֑���gJ#��ɾ'L�I���8�CVH���q��z+ѧ,��E� ʪ�N��$ج����g�s��~�Y,�{%~�\�+���������~�0���d���CsA��b�� 2Km���b�o:�����O;��8��uއ'�~������j�T��bZ%��;�����*��>��9$)$I�]6����6}.o/�ݚ3l0����)h�J�:�����)TJ�����I���Tj��7�M���/�1"���G��yH��� �s�~��6t|c����*,�u��+���U4J�F��.(����z������v��"��˳p��Gf�;RR9��P�!�/�ƏJ�d� (q/���e�� �Jȴ���b���u�j����Bb{�\$ޢ�u��l����ܩ�ӑ�I�M+<o"戆�B��Շ������U�U�/Ǿ����-���c ����q?���>���p= G��t�/��xAS�B�G�ly�!�T�:]�>a����x���0��*�oaP��֎�`�����oE�%�yv\qC� Y�M��G|^��Z%�x� ���֦H��3�d���S�N"r�5�X-��;��h���<�@�y/�jZo��"���� �Ll]��]H��#/���^��]&C��4�������+ݨ���Uy����g����因x��1�83i�6���c $3��ܿU 8 ��}���`}���/�/9�A8d�s��Yi���D'˖�iw�e3���q9 rc"yD!��� ��)�2��\��nzx�v|E|%��Y=�F���-cK9�b�]R��m���ߊ�-\·=��E"����uKzICr��������N�IX��q��D�k���Pė���rmk)|}���b<�[�)��oQ�� ;�r5=r�ތAjazm�Y��}��+���ˇDR�J������S^�%�����a��N�bЄ��dI>/�J��ݬ2��rX��˚�5�*��Q�v��A(�� s�c<'�06F�~��xU�=q���վ>u7���{�;���@߽�5����ax6�0��|07M
Static task
static1
Behavioral task
behavioral1
Sample
3sjNeR.exe
Resource
win10v2004-20240802-en
General
-
Target
3sjNeR.exe
-
Size
9.0MB
-
MD5
0b65657499922d87e714cfb813df6e5d
-
SHA1
51fde1bef9a0448f3543a8598a173992b2580519
-
SHA256
9c50a18543466895de389b1904409377295e7f26f4566ce1b9fae80e85eb486a
-
SHA512
6b644e090d3e259a0613187e32020dea2485b6668ea79ff206f50b020562b746e90e718761b92fa9c4e4924815c30b742388bff21966e955a29bbde0c8b9a202
-
SSDEEP
196608:zbeLXx4czFme15d3wXvqSo88oWTm/spwhPj7Q249:zKLXrznzwyl8hWTm5754
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3sjNeR.exe
Files
-
3sjNeR.exe.exe windows:6 windows x64 arch:x64
450bf39092deaf22dedef5983acce563
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
ws2_32
getsockopt
crypt32
CertOpenStore
advapi32
SetSecurityInfo
gdi32
CreateRoundRectRgn
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
user32
EmptyClipboard
CharUpperBuffW
kernel32
OutputDebugStringW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmSetCompositionWindow
winhttp
WinHttpConnect
ole32
CoInitializeSecurity
oleaut32
SysFreeString
iphlpapi
GetAdaptersAddresses
bcrypt
BCryptGenRandom
shell32
ShellExecuteW
shlwapi
PathFindFileNameW
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
normaliz
IdnToAscii
wldap32
ord143
Exports
Exports
Sections
.text Size: - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.`hT Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.C*6 Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xbp Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ