ThemidaWinLicense V1X Oreans Technologies SignByfly

Hunt Hypothesis

This hypothesis targets the presence of Themida WinLicense, a commercial software protection tool that obfuscates executables to hinder reverse engineering, often used by adversaries to hide malicious payloads or legitimate tools from static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially obfuscated binaries that may be leveraging commercial packers to evade detection, ensuring visibility into assets that could be hiding complex or stealthy threat activity.

YARA Rule

rule ThemidaWinLicense_V1X_Oreans_Technologies_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 43 4F 4D 43 54 4C 33 32 2E 64 6C 6C 00 00 00 49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F 6C 73 00 00 00 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 43 72 65 61 74 65 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator manually runs the ThemidaWinLicense executable (or a specific version like v1x) to validate, renew, or generate license keys for a protected application during a software deployment or testing phase.

  • Filter/Exclusion: Exclude processes where the parent process is a development IDE (e.g., devenv.exe, code.exe, idea64.exe) or a terminal emulator (e.g., cmd.exe, powershell.exe, wt.exe) initiated by a user in the Developers or IT_Admins security group.

• Scenario: A scheduled task or service (e.g., a custom licensing daemon or a CI/CD pipeline agent) automatically invokes the Themida license tool to refresh licenses for a fleet of applications at regular intervals (e.g., nightly maintenance windows).

  • Filter/Exclusion: Exclude instances where the process is spawned by svchost.exe (specifically for the LocalService or NetworkService account) or by known CI/CD agents (e.g., jenkins.exe, gitlab-runner.exe, azure-agent.exe) and the process path resides in a standard application directory (e.g., C:\Program Files\... or C:\Apps\...).

• Scenario: An enterprise endpoint detection and response (EDR) or antivirus solution performs a real-time scan or on-demand scan, temporarily loading or executing the Themida-protected binary to analyze its behavior, causing the YARA rule to match the file in memory or on disk during the scan.

  • Filter/Exclusion: Exclude matches where the process is a child of a known security tool process (e.g., MsMpEng.exe for Windows Defender, defender.exe, crowdstrike.exe, carbonblack.exe) or where