V����&4���Anc�J�$`�,��j�Y���D���G��V���>�q0�־]>w�cF'x����SP�3���li,���!��s��;K��rw�:Q.q'��(��; �}�t1��]�}��afF��6\kP{������ ���X\l�Y�R��N�3��}��pp��F�S�dL*`��,� baJy�bR x_�%��q���:�p��������>���pC��m4�Xl���jjDO���d�@v;���Y�X��<ӵ�!Sڐ2;w��Z����Q��(TE� SK��a�o��M��&�� x�䦢��N��40f.�çʘ���C�3�1���8�/�kQ.3�p�ò�)���M���q����)'�K�P�����������z_��ot�Z�����>V��D�4�3�"C�h�(����Ej0�) <#�\�d�� ���φ�5gi�# �踁,�2Y ���]5!oEY����-Z�H|����N<��ޤAT�2emz������$����VP� �̤�Ad�άb|dž��|ϓ~����'��-�i�M]~�A��?WUV��¶4���\Y%3�LN�U9#�7�Y%ȩF���M�n$jπ٥# \���1I�� ������N�1�b鯾Z/t���y�k�ml��B��F!ƒ�iƦ��ZrMSٳ�E*�̔T�y�/!��%�L}e�*W�G]ik�)u�-43�hT�`ˆ�k�(7��7uk�(z �Zu�%�+$ Uܰ�f���Q��F�%=ŞW�P�t���a��,��uq�|�JS�B?��,�Rg��k��b-���4�=T�H`��sW4���L��y���+Y[��i|�W9�S�%M�fjj� ���,��:-k]����b�$Ϗ�E���y��l<U��,�5N?|�Ul�`��/R_�����&�{��m�ۖຆ��ҋ��[J���DT٨�~|v\չ����B�D��6���� 8/�e�s��t�t�h$�v�$⚜��S����"X7�J��RF/7���$���y�:�+CHG����N�V�[ܜ�Q� �r����<��@����4ph{�� ��?I�yN�ѭ`��5�3��v�/��$�Tg�}��ٽ�����)��>pd�����0�$��� L��a��~����1�T��2�Y7�e��ΨPg��ֿU�S�l^�D�\�vZW����r��ӈ��Q%*���S�#�ǟw�����ڐ@nc��j|ϵU��;�m�-�ct�q��lۙ�m�����j���eO\l��o=���1����et6�ڊ���_��L�<ޑٕ�܁`Y��w��ܾ�`���vO�n� 2����kŌ*����I�Tl����H��_��a���f�#Ψ�BN�d� *ɨX��ABQRV��~���9��][���W��)�����5�@�O� "3L��N��K�i��"�a�>��\(u�U������sCW1��q���x���h�h.�q�5O�����6 ������F���ED]X�p�몢��r��i�鴾ߌD���g[8m�� ק����\�7�qm�;E��`n�nk̨4��*�����N3��D�L�dP��1f�2�6R�B��� ���'�}&��5�߄w`� �AZҭd֑(�L�V�,|aN3��T}��Tr��P$>C�9��*5��M0����ԘQ�/.���n�b�<v�i�~t���^��D:{�eB ��Q��Z8Gc,K���$�3*+<���nM�=xY�����R�z������߄S?~JQ��0��8������m4���C���N�uˍ����k�2��v�ƪtK�H�z�&mǺ��L�`���w ��w; �{ddؑ� 7�fސ!\�M��>���PV*�� Q]I�)�KHX�-�A�/�e���fs���&�%�ф�ͩn���}v�-�<��E��'�=I.pa���hq稭g�GHP������W�uT'-sƆJ,,�����\�O�r��i�Ce��ѱ��s7� `PD�9�s��À�J�/$K�z�ot8��e�*��9:�}�EД]��Lj��y*�v"z�s�uCح?�XcA�-O����qC���Y$��N��d�\)����`.6�>g��s)Cl�^�Q����M-{v�� ^<�.G%���LraKY()�\���`ﰞ�����v��OT��:ล�%P PV�g����)T�Y�߈����]4����B�ԭU��^/1�����H*���=�G����v$�Y��y����^�*���`,`�ZM �h��е��{m&���y�xc�iF!^���qXy,�\b�>l��;=M�d�N��`�(۵o0�i�G�H�4�Z�م�1��'��*\�7f���,�͐r�4���t,O���E��O8���{�8�����ȁ��|OFgz��;9Ө��g9����m 8�RMo�$h�+�W?�FR���A_\\�J:z�Ypt�{D<��B"M��$~�DMo:C���/�Q�,��:�����y�Nh�{� )?,u�ׇ�$�?������N}��_~���Ὦ�4~n>��D�O�k[ȓ�;j�bP[��ԩ|շ/w8����D��hw��L�ݟpŃ�&��0��<"(�>E�����1�����S�逅�U��k&���֟�oX��1����1����4���>��s&����U?���Ԭ��{E%4��j�3�E�$���syC|�/J��(�����=^e��f h�����`����Mɢ,+�Xd�Tq��HOwko�0+htT��D�_ň�ZX����+6�Դ�~�uk �A.������X�%ZUP0�R �n�N���H��V�@C:R���u���X^�V��`o�L��H5\�t���+��4a3�N'���7\�օҖ�'Od��c��=��!Ֆ�����n��>J��nZ�35(���&�fu�٤��gm�y?�����'�j1R�I��yu�hO�Y��q��v�$��1,r�ٱ�fT9V�;�!5��8�0�B�*[�1�2U�[C��¡K%͠�n��#3Y��'숙l�)�Y* ����I&�����a�
Behavioral task
behavioral1
Sample
onecrack.exe
Resource
win10v2004-20220812-en
General
-
Target
onecrack.exe
-
Size
10.5MB
-
MD5
f7e01db7e928fb6e44cae1ac362aac57
-
SHA1
24223227cb918a5844d969aab4a3d51bfb3b4beb
-
SHA256
ce0cb71caf000154d1ecf060561785eed816bff33d7c01426167b5bb5b5104d5
-
SHA512
633ac43b7081d91e5335bf4c323d33f8f2cd3d6d51c963285f858ef7db898fe5703cc7255a0f0960f55661832c93b369f7ee1cad2b5c4529da2218a9ccefd4a6
-
SSDEEP
196608:yO851eiTnV6ZgXvNbHbMZdJpsemxdQKz8cO9X9eR0qdw5ncbEo:y7/nbVbM2Rz3oU2qdmcbf
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
onecrack.exe.exe windows x64
f3d3695bb60b475277ba8a1292e6cd30
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32NextW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyA
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ws2_32
freeaddrinfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ