�����v��T���qr��iw<�C�T��>dA�&C�z%"Ò�A��yM,rr_Ύ^�cT�����m*�띟Z�@�g>ī�D�0vTG*�Q�6M�>�d�S��D=N����D ��R��xl$Z�Bܿ ���!<'b>v0K �\�[�@��Q�]���7C�0�r8���$�1�2���y4��`CK���v]]����hc�&e� �2���v��~N$�z�@i��٠Ȑ�"ޜ����_nB����X<���w?��5/o�����%;��5p�Z����d��-����#[xd]oy�)���z-���~�f>���b�|a�B�<�f�I5�Ѓ��SL���������]SBK�d3�z���,*�f����q0���]�5�W�S����j%��$��Y�f=��6����Yw�Q�:���;�D��U�%���P������8ͱ��H"�Y߲��e���4�pG��5��dLږ�<��gz7�8gs�k��W$mv��{��گ&>1`������w���e`_%;��>�A�<��_�؊%9G�^<F�`��H�- ���C��n�<D].j8[)G�n�`���T�� y�����6��a0}&�����͍W��9�,1!tw� �v�$�CX�Vl���"�����7�_�TD�!츄��.�?��*���c$�{Ź'|�ݜف��W~j�x�@!����|wt_��꣮0X�6���h��7XA�O�a)��7噛�ey��-V8�}lpᄢ��9���kyY�O�J���R�P�b�=��Pi0����rՍq[�=J�G�C��s�x�����e��� ��� +���Iv�f�7Ip~?$���h� ��,�o�/�#+܄Am��ՠ m{�!��Z@�I�i��&V���(ˠn�`,Ծu���pn���T�2��v��t*����"b�ڬ�͙����50�p����1�XiS �G)�iL�C������I�mb"�Ǵ�������J���L)��<7v�t Zh��.*�D�����f��a�W����L�ixv*�a��T�hC%�����r�V����mi��g�0��=��U�^>��?헬l*�^�MhQ����|����NELK=Y)!ʉs\F��N���W��xy+s`�wR�=���������BnaG��ez�/�G�'˞V���^��K��'�L���>}���֑G=��k��jo���=~� !�+G�ZBMp[�z.�-��uL���j͆�tN���'�2W���] ;�EJ���b�XY&��+�����|� �؞��*S6ڏ������K0)A�Q���v(`��V�_v̄-�����k�z�vI� nAN>�zC�L�������@T��\*�O� �P[�x�o���4�.�:��@����r��.�&B��K�?�FO���A\��0 � h�A�eڧ$���s���R�OQ����i�-�Cf �˼j��mWZH�v�5�d h���x� uyw����!���MP>��H_�����jw��~��W�hH䓓� ޘy]SS�c�4����K�}�Jd�k���*OӼ�m)0�*�>�ǧ��Ձʬ-�1�L�m�:Ђp��o�b0��Fܴ����p�#8ꮼe�+UIo�^� ��#�Im��j�`�#.��V���y����dz0ȴ��>~B�5�8kj��o��TQh�R��Dŭ"��(`�~�H/�z�D|�{|[f2���Kj�����ŖA�D��urZ��2�F��Nw9^�riW�Z�o�U�����I�Hop���LQU �+]a����e!���3*I ����������F��5�`�AY�����]˦ĺ���L����j�nZp�#(b!2���J�_$�� W%�ɤ�'C:x3��v�):d�&����w����z��<�~�J����iar�.iW���2����^����� ��FGZ�3<΄��s��!�Zn>7 t���;�陜����Rg����ԠU�'������(�Hp�5��,�Q�%8�&��g�����sŀB־<��O�'֔�t�i��ў)��*n=C ���:��j6W�j0�xե�&X�p�Ye#���(m�c���D��OB�fv�\V�N7�<R��cG�.�l�Z��K�y��X�*�q}ߒч`7�@�uv"C��-X\��@t�~�m����b�Be�'�h'^Unv��9y+*�|y.;BLL���]�}pJ^3V8"�S��A�$�)1e�X��ΔJ,���X�i��I��>_�����hղ}dLm�@M�#�|B�-��H�EZ��;E~����5#�&t���9N�M��9��Ȯ+6�,N�K`8�'a�J�H��BiC�lC�n�ڨ:�T���@i��; $��/O����4�/<|��y͙0���N��9�����t@�q��s�5����N�� %,Go*�$�$C।�C�m���[�5C��|�o�7�{BП����+�1'�_���;}��!M�~y�$�E_�0폠e�*è��asR��H�Y@�I��iz�NaL?��@ݘ�_��%��Je0��H�R�ז����&_;>���� h��{b�T��\��8J3�[vs�0��|봩b$P�Ͽ#�mu��j�P���������L�h<e]_�P�)@����܅8�wv�8��u=;6b����90<K����o�j}L �[���*��@��\`���p�{/�*D�z���F� �I�W��7e�P�;��"�0`z-ӭO�����{�F�ց~���0\Q[�ͮc���"�DK������-��ЀF�@��Z��X��K�����[��w�� ���RmJ��4�P���@�e������Dwd��O���1�*�tZ�"�7w�D�}I�s:XcO���zp��~��L�2&�Yy$�Њ�#T�/V�`Bo�m:���{��`�d� ��lS H�]�wFx��Y5�}ߑ�S&�bٍ���E%0�Y�0y�� 2�7��M��dP�"��#�h��z= B�곐l���ٰF���;5�tN�x�i��巎�K5��C���#�����ހ����լ?k�l.�k��ͷn�b_u�x
Static task
static1
Behavioral task
behavioral1
Sample
dEOYZVbzgtVgLKUN.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dEOYZVbzgtVgLKUN.exe
Resource
win10v2004-20220812-en
General
-
Target
dEOYZVbzgtVgLKUN.exe
-
Size
10.5MB
-
MD5
50aeb19da66975951135d751c2fadcd4
-
SHA1
16214a2b1c9c3f3347c94cdf3afcc66955e059ec
-
SHA256
3f399a3513fa86fc53b266e2ba9f8bd144dd61336314cb0163ee7279e59a4a04
-
SHA512
836cdbb002c7c77bdb50fc1fbefbcf1d13aab4284e0f1118c118d6594558115fde84332d8061dbe6d4a402b250e1777109163ab87a002ccae0c60cc306947f5d
-
SSDEEP
196608:Egwz2CCJeHglapCU1B6R3CMPvZSu33Nq1Xlc6dnOYfIg61:GzG5FU1MSMPv8Ms1XJdnOb
Malware Config
Signatures
Files
-
dEOYZVbzgtVgLKUN.exe.exe windows x64
8d23edf77d37ef2825a929cd77fdc55d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObject
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDestroyHash
shell32
SHFileOperationW
ntdll
NtMapViewOfSection
shlwapi
PathFileExistsA
crypt32
CertEnumCertificatesInStore
ws2_32
WSACleanup
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
"K2h!s9H Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1bnHE+P+ Size: - Virtual size: 702KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nJagEG3: Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HO'9eMrf Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PcK2hhcN Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
W"C^@ng' Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
5QMrDU6J Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
v0V;-X'n Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ