�V� �5"GBLTR96l��XO[�g��������H����ǖʠ�D}��$�FU�)lw|K �aw�����͌ L[i�\�8GX����7���W.G���� zCd8y��k �D�.�G�aJ�G{��B��>��!ز��X�>kP]6M��.6�mv&����mJv��p���[aG����ʫ�{�m���g;{��:�K�[36���Qr����u�z��T�D�L��~���fB����ܬ�V_k�+���_��u���K �>���{Ui��N�X�0n�xٗ��"yDe���L�T�V�B/̨�ڋN�`������t�y](�ؽJ5���Љ�;���09�T�ħ�ϳǦY��������Q.��0!R Em��Cf�^1�j��5��6i�`��� �q�s��C����퇞�I��D�4�|�j�Rg��2������̶M�H��%��r��i�5�gGra� uƻD�(�՜}n[I�Z�`�N���d0{B��JX��kwW��P��e�)�n�5>C� ?�Kܜ����Xp�N���s��*�Ɍ� /��𖫧`Sst4G���o8ې�O|�"Sa-%BX �"w���Y"-g��u[�nK�6��`k�?K�x9�L�=`tSfًWp��yq~�Ÿr����묏��ILVj$�H����"vD��fy�+�i�_t��-����>���!�o�q�s��T��z��gA��~A����3���y����-x�+.�� ��tY�fh2v�]��������?������u����q���+���|�;U�E�2h�]J�#�y��� ���l�y<�!&�G������h�9���ռy�.�N��\�Jd�J�C�"��>"��.&d�x�F��{'j�!G⦩Hr,*qP�I�#"�x�� LJF^t�Y������{ԁ�K��}w�6q~�7����Qӫ��"���a��T��0��)�\���1V�$����@Z�xN��3f�N�V���G�����f�%��U[/Ժ�k�v�]��/���Υ�����g��>�8��>/��N6'b��( �/����wd?��E|)'��S��=�D ����<@�kH�^��g��� ��e�ǻ�o=�Y����J\-$�0er*��A��荖�7c�^y$�,��_Sg�ܾ;� ��O"�EX��i�&�h�z�M���� cb-�2�8�V��==�R�'�P�a�������0`�����\:�q�H�]?�nM/�ί���؍�s���81<o����h�C��. �C�h��ۗQ7�ǔ[� �!�m ��bV�`5h������a;)�7fXJ��#�LL��pZ��G fY�Ӌ��e|"7eћpsiMDN����l��B��:������p��~�G�@Q��'����X &��K�æ� �.�:��_�Mb#�u�a����v��jNȫ�.sY5�t�܍�ZߤOG���2� �؊\�{���2��5YEQqj�Z��SF�uBdKIJɱ���6F�����f��lvP�qS�\i�a�F���,��Wp��b�J+3�Zu��\���l���3�J��ɱ��M�f�S�}j���!=����0������s�����4����#���IS����T;B�ؾb�^����>�:(�\~�lQg�G�d�I3x���pnE(ߵFw�9&1?��� ��ʵ:�K�hh�Ø��|�������wg�JK(��~5�F���-�����z� (�Vx�7��aGI�)�3Ǽs����[� � ��`�YLJ��DJpXó���_�M���^F���]|��W�`r^dm�r���[DD��?s ��_)�*��4#p��| ��O(�K���>���mR T���%�s�eϺV#��7^A1�EZ���/B���1'���%���W��9��͛+�_i�A#�'�dU*���W���h��ay�*ކ=���El9TC��6���`�tU���E�E\��^R�;���KE�[O(�6�g�cwk�ޤ;��JT�[�x ���J���-��|U3��{��_������2P��ɛ�A9��?s�_W]�N�,�ʹ�=�ϭ.9�M�}�2e1|� �P̐ؾ*�Pz:�D����XD����L`�7w½��X"�(�܂��x��Ba{�^gۢ�G��e�g �x�d[��[��Q��OX�3���z=�����J)h�pL��-� f�� <�T$��g� M�` ��˧��P7_̤ ~��WM^G���T����cY���J����x[ ����5���ӿ��2H�����ߡ��)�e���(+sg��;KaT�>Yv?�H�+.i��n� V�X��kvci<�j�6#�����T�e�4E�{yy��!�B�z��������?�u�KU>̕��O�#ݲ���Q�?�x̝��w�W���j2�'x~h�$�P6F�M� A��������(�'ƂE��ԥsP�>J�f;�4����0�y ��e�9��t�~�X����~onV"�|����l]��[��)i���:�Fن�[{������Clp� ��A��@��ЪB����\|i��H_3��-��"v֞WԊ@9W^55��R-��P~���Po�۬��O>�� f��S�/�m��_g��@����XTg����9�'ohhϴ|��*��<��$A�KNm��ڨ��p�# ��v�}�=���<�N�3�&9+�^�";��ۦ8�x���O�-�'囩%뮠g���8�-��b�״i��5~�o��hPP��q1N�vMA����71]��$]���t$or�����X��&l�m�����lG�um�� �X��tr���|'C�W�"�b�HP�H�G�#�c�)w�&����>b���%����t U��ڢֲ��y�6�l�E�Vˤ�<<!^�.��~9g������Na��i-����xz�^�P%�K �4�Y^5B��z@�rɿ�;����@��$|�/�����[E��7�q�=|p���D��'�|��D��fO��C�Wo�i�aw��DD���|mX�@O�^�;Ϛ���30�B��,����5*9QD=�`I;��'֮���?�3�#
Static task
static1
Behavioral task
behavioral1
Sample
777164927d1d5d4c9aa44515e6781bc0a20b39786ddb6ee9b0435c7d7eead161.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
777164927d1d5d4c9aa44515e6781bc0a20b39786ddb6ee9b0435c7d7eead161.exe
Resource
win10v2004-20220812-en
General
-
Target
777164927d1d5d4c9aa44515e6781bc0a20b39786ddb6ee9b0435c7d7eead161
-
Size
6.3MB
-
MD5
40e3126a94c13093e76b5ead732c7005
-
SHA1
976f8f8085551093580b60527d8e1bfac32f9e8e
-
SHA256
777164927d1d5d4c9aa44515e6781bc0a20b39786ddb6ee9b0435c7d7eead161
-
SHA512
6ce7948d19672de02d86672e6959c3fd0cb659eccc2991dd06cd5d1daeaa3524646924784cd2dc7397f79e31427c7eae1de4633eb096ca6bf4f04c19e4a0550e
-
SSDEEP
98304:8pP1TbN40JlTW0OyFEPX0vsEUXcfcka7q0lwsbhGhmj/t:8lRpJM2yP8IgoZldJ
Malware Config
Signatures
Files
-
777164927d1d5d4c9aa44515e6781bc0a20b39786ddb6ee9b0435c7d7eead161.exe windows x64
a6a44aa08f4e592a84d3f262087b8f18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SizeofResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ntdll
NtUnmapViewOfSection
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.V0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.V1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ