�t\�b7ov�KAO�d�d�-`��G?Y��z�v³�b.���T 5��-�Q$�������[X[٩�o&��*�d҈\VZ�Ё����>���(I����`�[u���pj^Z�SD�r]"$$�4��[��ɎS�A������S������O��hc��/�� ��7_�(� o��#���@���45�����C��.���Ȼ���dn��Y �@�qNdH7�ՖXŦ�+���8K����Wd�� �_���T[\n�C+Y�@b+�a�!z^���y���[�;<S$��/`߄`���`P�xS���A�����~��r|���[�\�q2�5Nр�{���BV��/�VT|)��ؗ���$eDDt��1�{� e��\�r���to�%�X���-*�ra$oM��b8k�OVS�p�T�q0�CP���f5���+�cW��� �+��{�#�|���@��/&�TTC[���: �q/�a筴ĒШ�<�p���9�I>g�;��8��}&��"|��T~��`m�N��3 �)�g���n+=7�1%��gn5H: �g��i�qM������?�w�@;��*��H��*���_�b V"�!n���*�ިJ��y���;���� �����5�^���TH��Sh��aT,��Dh�pH��O�������ە0ݵ�U#U]BZHd ��5J7GM��*;B�SnkC�i�ےW�Q&l��[,�j����IYg�T2��ݲ/R����ɦ5�n/�6�D� �敹P�{�,�&��yq���p.��Oj Fi���:��9�m<�iqz� �`�f�%d�����+Bn�z]I�H����H]5�<���Sn�q�Pt�lZ��f8j���� �3,��2';�jQ|L̋,�Fi�[�)@)�*\E]tJ�������� n2�o �� Q4ʜΒ����<�&�Mm��5�6y�uj�:�+��5�:p[otrUP'��ִdȓ|!�qԝ�Ǣe>��]HEW�՝���I��(�͘8B^/ L�Sc"{�H_!���gI,���9U�\���k_�բ��U��ΗP�ⷈ&��w~*�}8;�fs3Ó�u�^�%^���T�s �,Ұh�U�>{��s���q�G�,D�S~3M��Yg�7�.��^lp��@C���G�y�^5��/�t{1:�^�&�\$���EG83�VWi�������zX �| `P�m�GA��Ӻ���T � ���T���Nm+�[�"T��(�ɪ���6*��������b�����R����T�x��CV �)�P�E��S�w�-E A���x���]r���θ���ܩ��ZR7+3�~:�Z�����G�;�� >䬵��� �7����y��Jy ���t���v��QK���Ct,a�>:�w�����ϥ�+Co���@��������Ih��k�Q�F '*�X��&�D������M���y� $�������.}�~n,��s7 �K��w��)�ƶ�E0!��̷�=��+�茊4����0+�l���0U`�IM�L��mJ�Tg���D>��#Mc���>�p��+���[��@�˹�W�]ʐz1���L.������ï�b.�B�#�y1t�����-��>��=c��Q9��%��W��^p��HY�� v�y\C�"*��T��@;E�Պ4]4�b�u葶��F�&)'�pxS����������č'o�Ղ��AS�ױcG٧�9�h^KL�>�l�� ��5��0��_�{Idд�� �Sɻձ�8.�6y�����D�Ļ�y�I'=��^L�ڞ�c'*�u�:E�Ǥ�o�B�p�q ��&Q,.8;�s�14k��6���>�ŤƆ`��p���Ӕ�Ez:�m�7��y+�>��\�-i�: �^sw�7����݁��Ν.��#���u��`���{�pj�q�tl'�-�t�s���uH�8y����x��2ꭞ�{���w}O�߽� x^{����Qrm �V� ���; ���N�7����k����9����^���nV�m�����)�NU�YH�],�f@5ç�P �7~d���һ���o��_Q��b�.��噇1���/M�������&�'}(�疋�eRFy�������s���za;�@Y/2�H1w�)�>���nl��(!1������;�47P4�_�tv����o�~�zI<�]t�����ty��o i��;�F8�d��ɥ����*�����x$���C�;���#/��U�=_�Z�.�u���;��uv���J�cc��b�1S��XNn΅���'"��b��5��&C��؆Ul�B�(�)���r.P}R�>��c@��s�2���r<����)Y���ՙ�ţ�B���)+�;��^���떱�!��캋+�ai�ϕ"$��7Дs ��D���Ỳ��A���;��-��ST>*и��V|x�X~s��������ãh�w�5�),�� �z�A��}��@EI�a?�QZq���g��O�P�=�f�M����+�[g�xܾUi�����ݑDcG��I ?;o��ƙ�y���d�����k�=�u�=\ura�������lx��<סl(���a�{Vyd%ջn~�'�lu��� ��{�U�om �J4�-Ζ�Wn����m��¿�_�������J�˴���2�[��:��qrI� ED&(��U ����*+��]7�� qo�\}�� �m� F��L.uX��v�g,���An��W�r,�B�� �kr��Р�0߹>^�sg�=��S摇;�P ���!���,N��Nc+�O�����]ދt�2R�U'�*�OP���j���.xb>�E{��F�����X+m�5ޓfЍ2������>�9w�IognC�LǶ1n�+�l�'�'jͨ��o?��pݶy]�ɠ����}^� �{��ZL����~(Yi@�~��d�k�]�t��nt�����H-F���)\��]����x���-5�(7K;��SR4��F���8әl�r��˄�Ak�z���
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20220812-en
General
-
Target
loader.exe
-
Size
7.3MB
-
MD5
d8b82e2adab4d8ce14147fad24175b58
-
SHA1
d44ae2472502fed9607a9df601a3d63975f8cc4a
-
SHA256
007bdf789f64daf50881325ee07f4da64ee92255ee528edaeb144e343e4444c1
-
SHA512
f91f024e53524f56b997d6b6fd19be93a4729c2d67e14df00e45ba4d202fc0f0cae372e56f810657d7639338db3245e7368c926d775c476c6919d173034f963f
-
SSDEEP
196608:PZ2wXRMceUvePpXpaEaWAh4uvGOK3Sp63WW31tb:ZXRMpUvedYEaWA2OK3N3j11
Malware Config
Signatures
Files
-
loader.exe.exe windows x64
Password: qF2wAIIh8T&bxAsD*029amO#
21a65ce40962912a0f915a3a6443b191
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FindClose
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegGetValueW
ole32
CoInitializeEx
oleaut32
VariantClear
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rustsof Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rustsof Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ