���u Xۖ�~�A�>��?Ӫ٠t��p��0�#H-�~3�'��W֎g���P�7)�>� ��?�뛃V�����ښ��)X����lAm��q$�)\P۱7��8�%�yِ1^F"�6���|f�L�����۷�1>J�k��̰V���(n5��6h��e�7�f�a��iT�Ք��<�VZCJF�f~���Ҋe�6ZDDϫ�_��P�FK�V]e�� V{Ĉ�Y!݅���&�)8�m��ʍ^M�&d"5�� ��9��Ӱd��r؞��OPV���Nѫ�ޓ�$݈����� `���F-L2��ͭ���q�^n��a7�&�n��$ߞ�����K�I���]$�8�����ΐ���<������߇��}G���\6�TZ%��ÍNmk����<5���lm�h�z�����W�kRC�[sU{��Ă�Edܥ��x.�~%� �g8�y��xh�ب?�"�/M���]�?��������$�q ��ἵ�������:4�7|�`Bb)��kbz�+Фp9��Cs,�˿ lǰ�4��vQN����L���64k��U���Z��j��` *�f�=����mb��qDo2�GF�����䉈O�.Ju��f�5k���vuZ��9�@�6�e������D��I������*j�r��6���נ���$��DT6Uc 9�6L攐k�*s��� ʜ��.��"O�_g@�H����i����y�G�7:���%�yfl���J�D@�!�?���:��;>�ʇT��Sd+�p���#h��/�gs<�� .���s��\db8W�y�+����ؑ\�G:�6��A�<rH>��=��▢x4��V�=�;�q�j�����|����,"����Z��$Se,��iT@�DOɣ��] ��ݲ*�p��'=p���y�T59\��>���h\D����]ZON�S��,�&�K~Ɲ�+T�sHJg�X֙��K��-cz��`!�n�v�B/+��(!%!_wE/�:�X1�;��hF��*�� ��w*D�aD�?_��6Bs����V_�"�==��8&��<����2V5���T%���F�T$�T��L���ǩ����c/��q���LD_��1e�n�����">*V�'������K��h�TLw�7@��p��Rb���c '<!d�2�% �ZEJTiL�%'y���7�=���c������%���:��������E�ۅWr���������jh�$@�Y��e#͈�7g3��X�_�/T�r 3� On�����ߞ;�t(�|f�A�P�"�F����������%e����̭���%>$��R��v�s�u���l.�bK��� ���(!Y�~�r8K0zxZ��ø�b�QR̤��z�^_�צ�$'����:��7��$an��Ӏ�.�[��);��41S��)�� yl�D}Z�+��Db�k1 �1��Y�� %�arA"cN���V0�'�*��� �"��XGxeͯ�|j/�Ӏ�@P��� Ws�l�~x�jB;w���8l 3�cv��.����?F���~I���ma�0`&�uhI��FJE�VCj����DO������T�����b����e� ����=�����Mz��p��U��P.��q�z�n�P���S��xKށ̣�F[�&9f��Wc�����,�lB(|/3��g�́��*�G`4ۥ2�և���C���7�t�2��~���� |������� ֵ�?{��[X8I4M���a�L�=�!���m2z^��z�)E��Z�_��\ۍ���;6���>*�������z�f�rx1���ۅ���'mXЦh�|5Z+��;��7��������JiY(7���<�C��Nw���I�p�%�"G~������x��lV��Z�0� '�l'Pa�6Im�(b�u睫(���ԕ�0���~��J�l���DVW��npWQ�&��~U�b�?Z��,�15��;�����$~�m\y��f�-]Z"����ǻ���&C�Xt|���+Z����[��t��h3��9!�*���$����"�T�g4��h�RM���i�!�K�?t��;�J7��Dq�3y?@8VB[�`�f�o�g�eΑ��®%�dd�9�7PU6W:F�n�7�:���Ɨ+=N���n1DЁ3�%�aU/_7�����&���.R#���6�¦P��������6�1y��c���TR>hƺ����y}X����ƒp%��|��WB�Io�C[lzw��'��"��RW��y� :O��Ж�sW/]4�N�L>�����w ���' ���{�qk��^�� K���B�H��[�N����E�'�&b3��]��/���x|V1V��9��1/��[�q�h�¾���/VV! ����y�{xX�"�w�%&�+o3��� ���# nO�}���l�+��Ӡ���?(�\F7���&�[�tl��'u����L;ϣ��އf�~�!��}izt)(��>j���u6il`U�Pޝ��i���zjO�hY»/���Jꢽ:[s6m�5��Qy��I���T��� =чBꦎ߉�w!�>nɲ�/�n�>�����X����m!���*�T�<��X�0�Æ�/t�s%>�� ���' w���9t�A.ox�C#���f�G���f@R1纻���r�p��FQ�1L�#gt��ʗ?�Nʃ����7��{���x��t�Dx��=]��;NZQ��c4g�r�v=���p7up����i{����K�5{�e�J4>�{w�F��.!WBh���\a��,����]�0r!wǦ��"���$wWiɝ��6oy�w5��I�{|\�/�]/�@�!��ҧ�B�E��F�e��1�ؚκO���h�!���O��jy�-e)���/�����D�"VG~P�}y �X �nƤ[��I��C[H<\D�(�.�L��W�v���_� ���G/j �f�-���,�Ǡd��R�,����}�?��<����G�ג�v�����l�i����/TE:��V)sC��h�K��ΈbP�?䧏�]���Xg'd*Ǧ����.l�6
Static task
static1
Behavioral task
behavioral1
Sample
92f3b670b34b4f8085a8ed8ecefa869e105f077c1b17ffc253fe65d307fe8efc.exe
Resource
win7-20220901-en
General
-
Target
92f3b670b34b4f8085a8ed8ecefa869e105f077c1b17ffc253fe65d307fe8efc
-
Size
3.4MB
-
MD5
3e2ea6c9089596ba1f7af98ead6e533d
-
SHA1
2d3b22c1687c13a3e8e013b49f44ca05d2d010ae
-
SHA256
92f3b670b34b4f8085a8ed8ecefa869e105f077c1b17ffc253fe65d307fe8efc
-
SHA512
1bc725ce413701bf79d86ea2f83be08313f7330f3384b4080224f20899105c236346cf97aef075fb1598fed871f8f0149d0bee9dcfb6529f0d7dbddfc2cdebc0
-
SSDEEP
98304:mmy4UWfEseF0ptQn8gu6i3SyJbXftMN1LfMNPuIu7goY9:mmybWfEB0nQntyJbP2PLUMIko
Malware Config
Signatures
Files
-
92f3b670b34b4f8085a8ed8ecefa869e105f077c1b17ffc253fe65d307fe8efc.exe windows x64
7d9cf4ad35c0493fa4e35652a2b69050
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
wsprintfW
CharUpperBuffW
shell32
SHGetFolderPathA
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ssl0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ssl1 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ