)�-�ԁ����'xF���Z ����� ��������?�I�cdV3�}Le�:�F�G��=C��Im���MQ��I��͢�P��sx�����s��<�����p_��O,�R�$��d�}�>�W���$�p�8�q����A�|�7�vx���2��3��F�Y'6�bQ}p@�hT� ޚlۼ�T�Zb�6�{v9+_�o�5�E�^�����|&l����n-���R�oPc�L�"�-�-fmbE`�g�'5�W���{ne�FVڛ䱥Sָmu��]{vyp�CX�Y,<8�u}#�!AiI�3 v� 6JsG�i�SwեN<���E�(\Z��"���O]`�]~]��r�2FN��H� � z�C�_�}r��/�V��t5�\%���0������͚5�A}d^'�>C��;TXJr־��f���țIg@�%�&��1�Q[��hoG�T��]��6E�y�k.W�D��o�6��iH×�1����)R�&@�W�w�~I3����- �#���>�y-Ndt�n�H�z�P"J5zt]��j.������ћM������M'��T�b�/r� @Z^UOӇ�LkB~4�l:Ҿ��;P���$Fr���M��tǎ�� Z*�!�R��*w���k0jW�*�q��ܡ<�O=��UA�s+$�0�r��=�òT����r�PD����G�?�k�9`y'���1io<6��rz<�Ѳ� ��%������'D�*_��� ��_�[_�l1��8��ŗ��U��L����W�NW8�I/^�����<ʓ��!���c����s����+��:����%�6�)��uU��k=�_��zπ�^fw�y�������B����kr�h*��N�KN6��ho-gE�=?����kb �s���8�aø�=�qcZ5���R��u�ђ�].��զW7]%Iڈ :2�����C��>���f|����`[�0W��#��E�L<ڬ���'0J�O����;��2]+/{�2&�x�a1>��G��������*T�������PSe�B����ne���\��Z�Ad���@��+5�<W�>��-j8��7�D�A7�.zz�8�s�����I�j�y�9�a'�\��w���p���M�IX�KD�Nf�#�9Q�8X�Z����Q��T(���a�v�eJ�̺�L� �l���*� �#�ɪ�k�9 a��S����5�_�Ǩ��^����{OM�����T�Аmb{-�~M�+ �z ������W[�y��ٍ9�v���W�.��F��1ņ�`���i�I�����~�m���bV��D �K,���P�0�,���0\fߣ(/���@-���2�G���ҥ]̓"2��M��ԧD/븝�sb��F_�HǤ@����1xڕ��h�-�P��|�eO��FQ�5Ey�+>�����%=�)U�؟�D��X���ʵĕ��L�.���h�J�;m���?����0۸�{�/�}� QW�c��#���ml�ؕΛ�Z�A�<e��7��1����m&��I�xcF<�q�z���z9�Lێ ��`�Y�20*��( � /g�����,�]���W�����MKL�:D����,oԏ +��ۇ��9"��J�MK��o�j��^OB���_Ɩ<d�V��`��Z���h�+�u\kh��W���>�2��[�V!J�a�z��ٍ�g ����[KE����bs=Z~3f��7�u+�QFb�! ��DT=r��_�?�^��N�~��������������9��e��>��M�y�] 3����NL��L�F��\�6�Y�~��6�0Y�!�U�Y[{�n�O�a�[�鼇)�I�����t B�w!������RV��:���m��hVK��c���h�,*Gd�һ��`:�Aq���шRG� ���P,��(�q?>1�49�=I�����֬�ݴ��qO��I�W/��s99|��i�.��ZRU��o��W�wN�=%��&f?G(�9.��Cl��9wJIe�4������m����Z#*ɺN��qIA8��/����@�P)>3P!�"md�G���e���)���k�+ԨC��,eY��BT]���b��z6ظ�[y|��� �P�@j�o�lx��F��˹�A�(�H}�0avj���O��VZۤ�|n��~�q��� 5��b~��=���o�+���I�V�n!t@�#�` �l��O�����RU������W��Q)�7SD6��J]n� 8�*7�Ll��>;���>�P�e�^������Ÿ��q��Y�`�h( Faw��d$���5Z\���&%G��E��:�`h��<ލT;��~��0�����ao �<[�|�������N�J�����l͎��ݛ�4.X/�,��'���4��ly�َ��l��ڜ�u����݆�x�@�_F���q�FL�Q����"�T�J7=�:��j EUv����[p�*�$�rs2��Ɔ#��aߑد�:�7i��`��m}�(�<vJV6�'���N�����"S0�����Ok~�<d���M�2��Bk��!�~� ݴd��J[e�m�7����;/RZj�o�\�����5:OK�)4l��{y8j��|�}�ZL欋K�Ѽ������e��*'N=����E�FĔ�%����A���Vrg->' ?�?J�j�6����?��W붦�x��+B��(�C����h)v=���Q���i�/�C�x')|��Io��=�wOO�A����8`����ec� 3� �|V��^$1OAs�+�uNN�M�[��zGijh�Y��L�Gv��,����3� �|y���A�<fJ�;$ ��Z;S�� �䊀5���*`�9!��;���N�q�c�r�{>@��,�`Ӌ���*�����N��%�o�Wx��M�~��:y�@�� ��+�h�6�s&/��(l�����N=��uXR��Y���Zж�{� � ~<�����ז��;3pśO�%9�U�XN�EX��0���0O��m�l��Y~�T��G�Bf��U~B��Ƿ_~��Ԫ/���^ ����L\jB6 1| [ʟi�Għ���
Static task
static1
Behavioral task
behavioral1
Sample
Patch.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Patch.exe
Resource
win10v2004-20220812-en
General
-
Target
Patch.exe
-
Size
5.7MB
-
MD5
56fc709f5b8863abff5145aba8c91d4a
-
SHA1
ec6bc279af754bbb3f0414df582113f5ea981c35
-
SHA256
54d7f87b63343693732e4ca9d615d117374cead36d9eaee9aa70a04cfdae6e5a
-
SHA512
4a09d64c0f2a6bd8a616513febabaf9ab8f640493b37693eb0d25314e9dcaf3874d3ee8c59af61562e44691753301d79aa03606c08dbe4645d81d5fddb3485c8
-
SSDEEP
98304:Sv/Tjwqn4shleKOvmuuR36UY9Bu3Qe3Z7AMBqZrwT+V2n3F/TyHo32QF5Vvv8lI8:w/Tjln4sU+XRn0Bu3Qe3lBOrwiU3F/TU
Malware Config
Signatures
Files
-
Patch.exe.exe windows x64
30df8a71bd65cce2edab5b201b929df9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.owb Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Wh, Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3}= Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ