z�f )������¥}���M�Z��[-7�&P��'Ժ��Ϗ0���ʿ�~�nH����1٩uE=w��c�x2*�S�����!qP�j�E$t��eH��ScW�\h#vٰ�gDH.�~x���Ց� D�ܑ� 0gN�-�1������s"������2 �No�N@�%� ���R���"80��R�E5pYX���UԪ]�DIm7��/�������,$z���j� ���C���A�@�y�5��@�Z��G�w��d0OG��i�k�Sդ'�5�LJӝ��~F������f�+�ZN����P罚��G�yi�5d朙�=���m(Q��t�Yr+�]��>e�J���8EƔ~���,��Z �PC,�d&��6��lj\��ʌ��m9i�"_�����;�Uf�e��������_�T�o�EuwM:��(ܤ6��x��m����yz��J�C_t��s�w����(��.��NBW X�<y���<��IQC�x�Y|̽_�7oc�c��/Y�b,s[��B��T��D���Z�Kn{��ݻ@S�qo& �-�=��L2�V������-�;D�w��������<��Q��]\�)C������~T%�z�QuL ���ֱ 0<>�-�^}ob<-b���˘;�*�z�X���Ai+��/�g.r#�����Z�L�����d�Y�㐣�����JȀ���m���X���x�e�����%N���~�auy˞ah��ZK��$�a�� S�Â����`�>��jp2�^�C��]ޘS1T:�MI22�#���oD3G9,�@��fw��",h����Aߙ_�~�O]���ƘT._�r�*7%3B����])�Y^\R�q�k�J���s��g>��7Oz뒃L�B�\.���~"����PJ)�\5r��qr�!����D�6��Q�EW���;�Ă����������@�ʘ�&U�LW��Jyb3��P z�O3��r�8#KG�W�Y�k�.���;���HqXW��l����O�G���e�>)���j�����^����N[� ��_�d�";&�N�O]�&o�9uN���}�X�Z�ޒ0��Ǜ8�)'�GX�a���\�n��d&.�*��h#V!Q��̺У~zXB����q%�L-�ʤ��u�5��2���} m���I���^�i�uKF�!���/�6/q��>�l7��������dKSȞ'0����w}� N�9L��=;�OL�>��zĤQ��d�Ox�UA�c������$���c±��ݿ�'�/[2� <5>�K����P���fU�U�E�炏'�YΡ�z�Q�����P�d#��ߎ��&��ձ[7'm�S_t��u�N�Х�F���<�����31�'��g��~�W4?�+�g-&���╋4(�O�*1.K�0�3���~0����#�/!ی�h��i{��ڜ�\UZ:�#W���˓U�7Ƞ�Ӫ��i7�������5k���dX��ZE����x����������4~���d�p�*����D��0h�~ ���Ȁ�H�H�;�ˈcs+�����s��<⅛�T��]^.+��_��Eu\*����4h���<���V]�z`��©�l��m��:T�5D��J�o�i��&�軈�3�_�L2�v���>�c�専E��Q�J�$��,�}3}���\ �_v��&a�+�Q�%0�l9e6f=�@������?����j3�j�k�_�, =O5��mk�����{-�E���܃��1.�ؾ�ŷ:��ylt� �n�,N�k�{ٽ��ՠ�ј-`u��73ɶ���v��%1J�����a�i�Чt|7xf�Vj0:�x,�;�N@�@!$��E6�+-��MŇ5�-Q��F,����*��יJ I�d��_��$��&�)ϰ�|��/aW����\L1�P�wb5Poxг��Da��`�Q.��F�|�v��{������fPX46W���QtPY,!�n��{�b���|�r\d$-v�r��zDk�!�Rfß2D�pv �'"����T�̦����8�xг��7��Ԍ�Nl0���4�hRh�����)�Ϣ���9ć����na\�1����Pv��{uʼ�$a��}�ef%����lh����d5�V.S P���J���W-=2�����������m�ᴂ v�j��������#w�N�)���$D��h^�e�� `�v*>zE�s� �[� ����-�B5��@ Ҫ�$��+}�a�͍(`����ם�O���A�T4�hx!\�E ����d�ð�g���4�oNi>5 >�O+����w�L(*�!����\6̞�ˇ���A��E�-*Ƒk��,�oM}�L &��.E����"���@6���D$��U��VBYTe�}��!��a ����C����Z��b���Q���� ��q v����^�@�z�}1B�g�4������s�ȌS3�,˲&�g2�:�}sm���v&�� J%9I/��@sQ0ЈՈA����d�]y����?�k�\]�f@@�����-�� h�s%��THj;�(�%3m�Tt�)�] �px��Rh���n�I*�T��H9oz��A�u���nV����������A�d���7��p���V��R7�����%�>����� �_���dm݅������|����/0��W���{��`?ZV�i�8� �C���^�.ǎ�*���{��D $-{�Dov�ۙD����|b��lb� �G��Ɣ���ZܮO�zvW���ct�n�� sB�*� [\l�qY�m���$S�^�P�<�P���q�Ԅ�o铖z�%[8���AF���t�F�^���3����W��Fz,�� [�F�h0W�mV����(�\}>$���g�6��rSpx�Uq�g$J܍���6��<*Խ&�,�S��.6�ᐘ<�z:���3��Zf��u�r�M/���`����v1zA]U�� �MJtC㸨N��*s]P���ۊHX&�1j�L<���PЭ0�m�+-=`�V*��Ȯ�w��Qa��e��Π��� ���pYީ�S��6<�� X |�~ �
Static task
static1
Behavioral task
behavioral1
Sample
RLBMods Private.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RLBMods Private.exe
Resource
win10v2004-20240802-en
General
-
Target
RLBMods Private.exe
-
Size
8.1MB
-
MD5
2c613ec482ec8b46d3da6196ca5dfb76
-
SHA1
45d94073d2c0a81cca0f9c782619f422351b03a6
-
SHA256
f7569d54e9eb8c61e8954132b00e50d8a9c3d4b5dc915a023e0f7f2356a702e4
-
SHA512
f43268016299b472ae944a20dc8c64cb1385da8491160a140f01c209b726473a8f91738a523aff2c15158a6997adfec63cc8ebef0ed8353cedf61f65b251ec42
-
SSDEEP
196608:hxA0V2TGOX7FU+4DqvBAawMgXMqoHrJA6+frRuhoNkpJG:zAS2TdUpDqpAGSmoGDG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RLBMods Private.exe
Files
-
RLBMods Private.exe.exe windows:6 windows x64 arch:x64
4121bafe72dec62c7f7afef9ec256dab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
webview2loader
CreateCoreWebView2EnvironmentWithOptions
ws2_32
ntohl
wldap32
ord46
crypt32
CertCreateCertificateChainEngine
advapi32
IsValidSid
ntdll
NtClose
kernel32
FindFirstFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shlwapi
PathRemoveFileSpecW
gdi32
CreateRoundRectRgn
ole32
CoTaskMemFree
msvcp140
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
userenv
UnloadUserProfile
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptGenRandom
vcruntime140
wcsstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-string-l1-1-0
wcscat_s
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dot0 Size: - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dot1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dot2 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ