ThemidaWinLicense V18X V19X Oreans Technologies

Hunt Hypothesis

This rule detects the presence of Themida WinLicense, a commercial software protection and license management tool, which adversaries may deploy to obfuscate malicious payloads or protect their custom tools from static analysis. Proactively hunting for this signature allows the SOC team to identify potentially hidden or protected executables in the environment that could be used to evade standard detection mechanisms or facilitate license-based persistence.

YARA Rule

rule ThemidaWinLicense_V18X_V19X_Oreans_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9 05 89 48 01 61 E9 }
        $b = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00 58 25 00 F0 FF FF 33 FF 66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ?? ?? 83 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the ThemidaWinLicense utility by the Oreans Technologies vendor support team or internal application developers during the annual license renewal process for protected .NET or native applications. This often occurs via a scheduled task or manual execution from a shared network drive (\\fileserver\apps\themida\) to validate or update license keys for production builds.

  • Filter/Exclusion: Exclude if the parent process is cmd.exe, powershell.exe, or wmic.exe and the image path matches C:\Program Files\Oreans Technologies\* or \\fileserver\apps\themida\*, and the user account belongs to the AppDev_Support or Vendor_Support security group.

• Scenario: Automated build pipeline agents (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) executing the Themida license validation tool as part of the post-compilation packaging step for release candidates. The process is spawned by the CI/CD agent service (e.g., jenkins-agent.exe or vsts-agent.exe) in a service account context.

  • Filter/Exclusion: Exclude if the parent process name is in the list (jenkins-agent.exe, vsts-agent.exe, git-runner.exe) and the user account name ends with _build or _ci, or if the process is running from a standard CI/CD workspace directory like C:\workspace\ or D:\builds\.

• Scenario: IT administrators using SCCM (System Center Configuration Manager) or Intune to deploy a custom script that invokes the Themida license tool to verify license status before deploying new application versions to a ring of test machines. The execution is triggered by the SCCM client service (ccmexec.exe) or Intune agent.