����W8lٌv�2���Yd�����00�������\�X)�������Y��e&z7���>#�hl����Q��S���mL��mR٠)/څ�ƞhm|f�g*<�]��q����i�Xz\S�t��Z�um��m,�����g\ލf� �ކ��w��@�D��H�����\X�5�S&���S�q���EK�#����)�zrb�t�/����&�!x,` �� �k�Y�Ӳ���+jT������q�N7���S��PT���nNŵ6Y���V78U������j�!o&Un�i���|��lq� ���6���d�r6�%{�a�y�H����waA���뵑D=K{���ߎx+j Sc�f�q��)�4�a�WP馳�(���q ��_��"�6�c骞��2���KK;ܤ��U�X�����Z�B�5a_=9�j�Z�[U��6���u�eB}��L�%Q����=فJ���c6�i)E�[5��@{�� ��v_���[5��i�����?�[ZC����4�G��bN�sױʐT��|��cc�{�̛w�öie_�p�3{t��p��3��4�v����d;�9\��m��.��DlxSq[ ��dg�/��N(�i�Q ��U���1�����ؑuXV�80m��H�ԇ��'��Ũ�z#��y��U���+)'~<�`�AH��/�]�8� b�Wd�����M�2b��|yk�3}x���E�B���F���}�;#���Q�!�R0�LXD��/g�7�h�@,�p�0_Ĺ��8͖P Z��� �%�THu0�R2���2B�A0�H�l�tȔ����ObNL��h%Po�l����u����n�}H��v׀z[���UR�! 4V��G>,WZ��b�ɚ �j\2��:�~r�~C�=���8��1���P��4��G �"��5ͺ�ȸ���^Җ��ҕ�B����q/d�n��M�� ����մ�<����r�yG�kU�D����Bg��.f��P�`<g{w�ByM@l�zz������b'�¨lHm��g�k/%���˫��)Z$�����t��x�*��*��61�0�4XS�� (�<�d��q�}v��(�������XW �Y�E���2vvoe,>p�� f'!mͽٚ�X_��W�S͖��5oiv�C4b���x*�k&KoK��uN�o���ɠ�}s���;���gQ:ḩQ��$p��Wx�>9��+ܙUˡ�4�A��i�� #�,���A�Y���nĀ��#Jg�{�-$}��I��?���0Ur�d����t�~��1K����0owfWu�g::�\�ʐ4�w���&�q��2�p�:����� �1����5�����q��@-0;��n�$&�Oev��}���6'�Y{<�8� �O֖ю�����;#H���Yh�)'�I=�>k2��E���\�r43���PyseeM\���!�B�:��'�7&�eb#�G�r������i�s�a���`嬒��B���]*F�is)͊���nL��_�k)����7(hv[�b�O�ϮA_|V(�\�ւ`|�J�er�'��H�ȘO�F�������z����i�㗜�w>����2t�2��P�U9�� E� �������7�?e�SE�5VI։F�js1��5����}�lM��۵����_�}�q�<�Q���5�,=ܚ��R���Y����QQ������q�}:P��l��{-�����7��sΙ��sg�}H~)[�#�8�Ј���b�4s_HW%y ��B�ܲ0tv����D��K�v���jR�T�# JnV#O��_=����}&��}4�6{Օ�W�x�s��/ܗ�%Vvd,o�:�2���)p�wȣ̳`L;��]�����_�R�ۤ[�@��o�Ҩ_vw�\�ѝJR�1� ��÷���gR��X��b~ �9^G��$�)`�Pa*&m�A/3!u����.��BD\�< ���/����N�{�*�<9'6/o@jF���Tq3�S�Yt�QF,;�P���k�`�P��aV�o�D���{T/y/�E����IVȜ{���2�.͢�Z�Q�������W&?j�bؾ_�� B~���t?��Eml�o�7c=��J�0���j��}���ͩ����m��0�׆�`(�����c��;rj��~��~h����8Vn��z(=7 �[�C�IkZEec�C"�������˓�4�A½3+YcA��Ɯ�b�O���F恫)L(5���x*c ��L'_f�^��}�q���(E���2ć(�.����T��}~҄�b�����0l��K�rсp=蓮��GYae�w&W>ջ��'�M��HGD8�"ݯ�����mT��~&�|��^P.D�U��@CYI╎����Tc�9�Q��R����AQ�<�~���{��&�D�Z��uf@�{�#�Mϐ ��Ǒ���뻇��2-�-&�)�ָ�+��}z`�&/H�s�$1��ůXR����Y����;�";���� ��Ȗ����F?��Д�H���e��O��Go��@x:�Û�l߃T�n|s��2�m�acUC���z�?"H����qG��8>�g�-�KKص��'[Ǧ�����u&c��DPwq��}V�y%�L d��K��|�H�oFi��N����G��LO��*CcY�Ox�Ko���*��7_�`�B2%�a.��/���*�����əwS��U_6�/Ҕ��U����>�qW�b��@��ݾ{&�#M��xȃ���*3�tx)+bhVQ#�:h��1^+�A+�ڼ��S�;��B�TO}����`}�<*}�I��]7̟���E �`]��f3�j��r�(YG4Zՠ��62�E3M�ɌX��>)"*(غ��v���^�+��;���q4����51C[A���C��22�G��R��Њ��'|ذ�9RU�����t_e�"�D��Rd�g�?���:Ҏv�`�� �f��퉦%�a}j�ˎ.�s :\�EH��"N�ϛ#{�x^ҨYQ���s /�8�R_���k���RNC���WOd孏�?C�ɾ1��fP��.��@�
Behavioral task
behavioral1
Sample
loader.vmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
loader.vmp.exe
Resource
win10v2004-20220901-en
General
-
Target
loader.vmp.exe
-
Size
10.7MB
-
MD5
f301b44b9b6cb9be49d74064e8e1c9a2
-
SHA1
673ab5e26474dab678b625dbbc8926166eb225bb
-
SHA256
28a44443150a2de832220f310e5868988b3c3d590f21372c516a81b121a22d21
-
SHA512
2df3ae805a28d54a2ba26a2bd3a943ce02fda046b54dfe7beed91dd09be2887d46b7d8fd0afd85db5a6993121135d9b3d154f5cd0fc2f4c96adc07bccf521461
-
SSDEEP
196608:5t0vrt/t/OPG8j+0ZEzNaRx8oOtDxA0Ba5SbAt6N/fh87Jrhikbqd8sPSvx/wFG:IxqM0MNaRmVAXSbM6Nh87Jrbqdz6vx/s
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
loader.vmp.exe.exe windows x64
13367fa63328da3fd276f1981cb420e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileMappingA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
urlmon
URLDownloadToFileA
ws2_32
WSAGetLastError
normaliz
IdnToAscii
wldap32
ord301
crypt32
CertFreeCertificateChainEngine
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ntdll
RtlVirtualUnwind
advapi32
CryptAcquireContextA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ