J����/����?yUf?p���|���SKGz��yΖH���L�Z���tK�8�5<B��R!pY������^�_ூ40ـ.\-]v�NY��Tt.�#�%x�oB�ﴴ�y�e!�:�h�!��ӡ��I��5̭�9�4�- .�U=�����x(�+x̒Q��`�+�>[[���L %3 �^�KbF19].��ڴ���3HW�9����bg�����- ��X�����v��������QE��}��U���6���Z6���lR����(�����l��MW�B�@�=Y�ǻE�g��I�Cf|@ �B1��2'F�WK"s��,���,e�����N���= ���p�Ȍ �n�Ũ��ɝX��OQ��,���}0�'%��z�NE�! �/�.=��ĸ��Dž�v�+�u͛l����Cn�><T��F����ZM ��p��2Zj��>{�I��\ԃt�IQR]�H����7����S�2`^� "�2����V���<B�8�!�g%�E#��s9���aonKR��sH�l�E��+/C�ʏ@�O�Z�{ߒ�����!jY*�>b�k$u;joZRR#~�1B�dW�P�;.>��c@���^��d���7s���u1���N[������~�B�MOOT]�����3z*�-�Us�e��K+�F�ޝ�A ��ʛoՕ������R�J^8HTp��jX�����`^� 51�����CY��i\�{[}��K43�m��_3����x�� Iгs��i�Am_gDn��9�L<��L�կ�CN*?h=l�g5�i��v�qy��0t��J���~V�G��w�0�8�[+]4�G��ևx�ن������?a 5Pʀ�Q�bl ���~�R w+,F���"�����o��*E���f��[ \�� ��|vRIA��\� �U���P�U�>نB�Ob���W���*J����kAwօ_zWb�N�Pl��z����ō����Na��z^��Zz�a���c�{����;��h\�,��{���C���)�B\�x��hO0��4r��o�{A�%E�okl^z�Z�{�ƴ<蛏6�����_H�Hh%��2Qn>Q�X4��%t�>.3~�vaF]ز]���[������/½�zD��s-���3�Ue����L�JX]�g����W4-��_lM�64�U���8�aD ���0�=j.���n�W]�<`nf� ��mQ�E)�.f��j�j>�q[���!�>;�l��X5R猶V�S�Gd\���?���x�Ҷ肏XJ���|{�H���w a����t/9ȕ�@@Tl͆q��-��@�H_�';+�L�sC�*^<.�k����mlx��rY�����M��`@A�}B8Y�x��$v�'�c�����Ș1���&�����؇x[Ι0��%;��Ĕɇ!��j+�m:����w1V3����z[\���-���;=�]�<�=�W��kG�!�� �OJ���ss�bo���#\7����r�m6/T�V�ג����ਯ�B�ZN�h�C�p4J���yz�RaK%~p�Y5�������\��z�ωY�~��<��P��9����&o�4���E���$Y �0�O���|K��h�L�=k�J���U���i�3F�������Kg�H�,�ʮ����ۀO���9��06h���� ����`K���Σ$��Vh�+>'й��6k��d�`�������|�G�k�4���Ŋ��&�GoƂ"ŢdLQc�5�w���|����V��a�A���p�D���J��H0��a&�V���0���� R�\��f�6����M(P�.����.�1/�.��d�-����"�)��t����4����m`^���A�ڹ�/�Fی������;0G6�W��N]���v���T˅�l���� 9�Ki��QkƵ%���b����+K����ӑҶ �L�g��G��Zڵ���e��08� +l4T��f�.oM�}�o0���#��]S����r�!^��+��ǣM8�И��[��^ǔ>Q|V��(%�W��ji$n�y�e�!�}�W-䵭j���(n���t���妚Jdozk`je�c�,vG�&��.�5F�W�t����:��\�fC�*C��5Ѽޜ`��Y�LX�-�D�t�}����ѷwe�B�aK�����Ax��2�l�b�����Wz��3l'�iN)�/ #ZS��D�z�<�9�fs��c���� �����fH������2����W�!�m�q���E����T���7�n5h�� �1��bR�C���6/�����-�Q�{������'��Cל#="q��u������ʚh�c1Ͽ��T��µL�jR9%S@ܮDK��zZ��ADX�w&��)��I9f/��ӗ7����+�_��YzB\+I�������99�b��{y�}��$�a� �i�.(��$Nw��cs� �ƨr[W�L�p �[S�\π�X�Bi���q¿� �tյ6�bI����QnV� �L�64Pmiѱt��I !�����?xƙ9_�J��ʠ�c����}�ԛ����_�'�z_8�w�\b�Hz1�qĂ<�1�����{�c�7�ꠐ�m*Q����[ ���s�����sv�h�#���V�U3ǘ{�����W��z3Z���rd�*�� ��O6�9g+и�J��7Y�4o�����ĺD�TB�^(dXJf�ʙ�F8��M'Z��) ��MP��i*�}*`�=���g�"�-��Q}�3+ȍ�l��SF�h��%� �rb��`��k�h6�ؓ��[H�v:��WS��T;Φ�&_��=.%��;!� {�Ƌ��/�8@� y����>��]��������C�&���Тܘ�nF�nk�Rƕ��qx��+#Q�ai8�2)���?*���ٽ`�H~�"�1e%�X�=#����j����47�m0W�У��\S�AppJ�J�=��RS����WY���7�Y�X�|& 3�P)0Ƣ23íXC��K,�^LnK#i*��\�D�k>��j�H��*�-!-�*qY� ��쾣nD���,�'[N���_a���.g�J��5�A�������H+1paR���
Static task
static1
Behavioral task
behavioral1
Sample
B2D7F0E65AC1E971ED14878468C2B3099E5FF0BAC0C83.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
B2D7F0E65AC1E971ED14878468C2B3099E5FF0BAC0C83.exe
Resource
win10v2004-20220812-en
General
-
Target
B2D7F0E65AC1E971ED14878468C2B3099E5FF0BAC0C83.exe
-
Size
5.9MB
-
MD5
f3ab8ef5b421c35c15c3ace8b9ff4c5b
-
SHA1
768c0f4efc833dbcd37d3610788c04f64268cebc
-
SHA256
b2d7f0e65ac1e971ed14878468c2b3099e5ff0bac0c83ad59dbc9d281c20b7cd
-
SHA512
f327f79749f5bcc7362eecc93e96ff902be9ec47e25eb0d028550e798fe81b3e68db28b6eb0b817006c8511fca8af5d37cde82ce2445bf359a62b8fece09e2eb
-
SSDEEP
98304:gztPEIohxzpyWxuKqSViP0OfANXEsHAbVPreag6wRheGiYxMSTmb6Um4bVk8sA+H:ghizpyZgVisOfuXlHCVSr6wRhRVPTmbY
Malware Config
Signatures
Files
-
B2D7F0E65AC1E971ED14878468C2B3099E5FF0BAC0C83.exe.exe windows x86
42f338d74ee668e4abe4021bcf6f42bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
GetModuleHandleW
LoadLibraryW
GlobalFree
Sleep
ResumeThread
CloseHandle
SuspendThread
CreateThread
WaitForDebugEvent
SetHandleCount
GetCurrentConsoleFontEx
SetLastError
SetConsoleCursorPosition
GetSystemDirectoryA
GetFullPathNameW
DeleteFiber
SetFileApisToOEM
SwitchToThread
GetConsoleOriginalTitleW
GetProcAddress
GetProcessWorkingSetSize
GetConsoleAliasExesLengthW
GetConsoleAliasesLengthW
GetTickCount
GetLastError
SetCommMask
GetProcessHeaps
GetFileSizeEx
FindClose
ReadConsoleA
GetFileBandwidthReservation
ExitProcess
GlobalFix
DeleteAtom
SetComputerNameExW
CreateFileA
SetStdHandle
GetNamedPipeAttribute
GlobalAlloc
HeapFree
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
GetStartupInfoW
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
WaitForInputIdle
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ReadEventLogW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
Zf?K(9mP Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
6SR.sXp? Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aG'Iv>Vs Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-g\xReOr Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nq_3PT>+ Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
c*C`^)w= Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
z5a="\:z Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hzyWP7M? Size: 98KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ