��wPAv;�++�I�aO};�1��wd銰$Z���R9 ��Vj�/}��%�+�,h��2�J.�E"��V����S ��R=���@@`u�� �Y� 0ܥ6é^_��mB6�yk�7�U��:�U����U��$�� �ޥ�2�Q��k� �en0���P�z7�P�p�:Q���� a}���<�V������͇qT` -l.τ���$9W�3����:�@�c���J�7f2�r��d9�B)W��W��*!�1�����ӡc���Ȧ6쒱�53Gg�c���++k(��~�?����Z��I�:�� ��ޡ��@T1�2��ыW>�H�|{z��~�=4~$}D�l��7�ǃL䦟:~����c�$aY���\��V�+�sCd�$��j�e�v��Ȏ0�^��nø��K�I��vJU'�&�w�[�&��GЯ]����seY:��PC�Fz�\ԑ�OHU�Ɋ(�3�����T�gJ������yd)��-�?��� �%N� 9lӉ�T-m�N���?�K&��z ��Ʌv8����_۴��ĉt� �ZN�d�$����{T\��a*�^*��A��'mQ4Q�.�|�i�G> ��Ls�dAT�!�w��QE�K�s �Fyl�61���{���9�#d��B�T�>��j�/7�H��{�x�ו?�Y�bq6F��a!c���:�v)`@��)w�iЫ'Uu���G@�d�F���0CMrqf�>aj`1�<*K7<E�\��t&"���rSw�j7;����a�:Ƞ//��캋o"'�@ͧ�PE]E�&1��/���l��V4��Z�M���PM)oK�ΐF ؕq��jUS ��x!@�2�b;HeG"ehe�/q�x��:_�ԲA�H���|��n&S��(L���v��)G��V�v(Yc�8ow�зF��|���l�[�0���hTA2W#�e��U�>FEP�����Ń⸳-<x��)D���7/�A|�ȱ��3�S^�����̭)8o��D c�C����ڰ�d�1�:�.�r����D��Qu�2cҏP��I/�Ι��0���R6)6E#EC�*\�I�ՠo[�$&{��>0�c�.��C��.���� ���Co�d��x`�3��`Ӣ��g\�REE�N*���N� c���,�������g��T�D�w�%趹2XX/3C�1 i�Ӑ�`*�|�Eτ���҃�k�h����� �K:6��xn�B�2�{�G,��H����&B�Ͳ�˅U�"Q�i8-:��9.��;�6��i����d�f�l�[^���� eZ�vۥ��{�� �[Y���N�J�N�I���ᖄs���J����O�|��G�H�*������\�,0r�ɣ�|N��: S�I-/��mR\��,tff}9�Z�eumk��u�W��0 ������?�E ���<�C��4�z�w�����(� v�y����*�g�8RfD�Vh�.�{��I�6w�B{� ���r���\O��+�|ǚ����I.z���wn��"7o�䒋�0����q_����s���xf�����m�ɨ,�~t?��␟P��S6�3]�z��--��R4ףo7���n"Bw��ܑ���T���F�,��N�ݟ�T �s����W�`��P�6�x�Ah��_�%T��e�WbM^�M�Xg��x��1���&����K�&�㮄-�s�['D���IQ� 9�aƐvpޛ�t��S�2�K>������[<6}��չ�{��.����f�A��H���e���)�G:a\��V����T�����U0���,ȡ�l�:i�.�ɩ(���23Ax�Q�6a�,K�e�6����/����*�X �nw�U�/iP��]�z�N��>�e/��N������Y�^r1�CX�-W1��֪��!)�%E��d_e�,�֡Iw3� N���dh��Y�87�����[��<Ui�y�x���kI�x���q��hI��#��FG"Go%b�f.g݆F���Vv�Y)OfA;�r� �d�O��>��DEo#o�F�}{U�J�@KF�Ҋ�{��>t�J7�D#�˿���qB�^�d��Ik�㦏�v���2�z�d8F$s{�c�Oy�)⹓��X�0 >��b!���eP�����]uW��=��b[K��U[ V �'���c.�ھn9ZG>����Q���rԼ�wӌ��\�6�����;�Ή��d`��(?ȕMۛ���i ��M9�K�p3y�Ȫ0���>E�q8���G�06�xC摿»R�)��Wޝ���VS q�t���<S�O���y��$3v���)������o.�٨��F+��E�\���*�L@�@��ߙ�2 ׄa� �do4fM��?��4��y�:4-�'05)��Gq��R�%�,tz�K�:�i*�E�P"12�|I%�>.���+ L�@�@2!�k�UU'*���G�h�� ������֔���1���\�P+۔�$M�2�*!�M�&;r��$;R:��QQ���U����#��c-3O]��F�0��R��A�CaV��&�X�n������l���`Z�mʑ��v"����2F�ײ�Ѧ�������$>�90;��1I�N�ԙ���h2���v[&ԫ^v��R)��$����Û2��D\�w1 ��&�9'�g�����Y�Vg��4f�4�&�I�(������鑚D<R�%721�&��B �4�s�{Y�C�ձ/�f� ʱ��J18�1r@�Ѫ�h�ey'��4��cL��j�9\�����;͊�QU�ޱ<Ov� y<r�j�Ej`�V������i���y���#۵Z�W&�_���e�L��)�F_*s ��]{^�^uc�����Tu�iC�=ځ��TT7tG�Ҷ}f��f\��qi}|D�o'b�i����S�����Ѷ���\ޣL�z�l�r�ᚡ۳�Gu4o�H�~����%ԉW���s?�>��7�>m�n?^��H-P ��fwN�&b�jQ;C.H���?�m�-0���*i��9 `M�����{y�m �2��NV�֞-Ù�
Behavioral task
behavioral1
Sample
HWID.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HWID.exe
Resource
win10v2004-20221111-en
General
-
Target
b1842c239be6a6a317fc39842678e6efc1802ada1be22a1961702a2afa6cfb1c
-
Size
1.7MB
-
MD5
6b4d8286e91d78be5c80a2f50dffa6ae
-
SHA1
50bdefcd4ae8983e4c01483d67f1b3a1c25f3401
-
SHA256
b1842c239be6a6a317fc39842678e6efc1802ada1be22a1961702a2afa6cfb1c
-
SHA512
e55597fc0c59fc6b39b4bf2f754132e91135767a29833160d1ee555957ecc7257781e1573dc778a6aa10967dee0491eb6ac546b2513236daf8ac7dd1c9f27a90
-
SSDEEP
49152:H4/bxF2wTOY8THPBjx6mJ5lEfd7Pztj+FGVPTFK5EJ:H4/3Tgtjx6mXlE5Pz5ik
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/HWID.exe vmprotect
Files
-
b1842c239be6a6a317fc39842678e6efc1802ada1be22a1961702a2afa6cfb1c.rar
-
HWID.exe.exe windows x86
b3d79a8b75067dd7d37f917deb97ed62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.textbss Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ