KǞ$�����oQƟ^��$ ��s%"�#�M��s |M�^briN37h�`:��lG���'�@ ��b�.��'"� �-}5`��t�@P�|�%��j:b/�V)�i � �/�.�a��>�%LZ,hk �d$^ϥP�k@��<�����ル���:��C״���[@��?�[���I���E�(ֶ�+)5�b%E�E��x=o��� }1�X%�?t�����q���X?g�<{��P;sp���9���vV��/q�m�8=��)�x]��V��6�3�W��1���CO�b�[ �$[?�VQ��U�0D�+�M0S���zk��v��;ۙ�g[%�R履H&����ߎG�%#@���/<YK�hgCvr;`��Kz�M0������)H&� �GS�CC7 ����o�9�>����y2�ܙ�=�Y�X>��v��S<o���-ԩ��n��v%��E!p.7����9Ip�l+`����54")8�.������W���#�zX�Z��������\6GQ�Y�Z�����zP�2Ɠk��K���������{f/-�2r������yKn�|M�i^�^t1ڻ����T�r�+b.�Q; �q)y:݆�ܖ��^�-"�_��H���V';�$�b;O�|�!��v��0;E����L��Q[���NM���p�M/�臆$�{��ߟ"��1*�|�� ���a4�9�Cm'�,��A��~��)�p�O_�����k���oDM��P�}l�s����i����]�����Ab��0�@D����䀤�l��[���x��� �L:�l���Kp��������4�����g�T^�S�wYaCd�nsd��k�n���/�W�iZ����@i�,�m�ꤕM�+�y=�E+s�:����xK)����.F��ny��s7_�u(�aj���`*4�M9���I Ok�Җ�}~�3ڜ�X�t8��Zao��}�k:+����A6T� �|�>��D\f��� ���#������@�Z�N����1,L5r���oQ��. �O�q���E>�����\�-3.��Q�`:R"�S~�aQ$�/�6�]<"�� �2��T?���5�?g�L��6�YzT<O�Ef�" %�QY�{�� P�O��pޅ2o@~զS��%CBXC��A('Ն�x�űn��5�lD棥ˈwe�LX��C$� �1�`�+��Y�F�#�_��K��Ev#0��s���-N�w��4��H���=z�+P?I�ؿ��&�����X�=Vg��eй?נ2�m0X�TF��r�l�÷� ��K�'�K���q8 �Q�2����\͏I"5�jooAtH<+}|�n��7ݦ�F:��@K�qG�+*�n{g�H����c�����q3�cO��u�M+!}��_�x6`[�<bv�]�ff^��'�[�K%���E�b�.�+��]ʮg���\FO{�8�&�\�ɑɊ�����A��W�"poo�ܠ�i¥��ap]�qk�M��d�(��U���Ra�VA��kp~R%9�,=pc��`$m )A�[p�~đQ���G$(x�]�֙��{�LR̂Y�B鰡��륏�?�_4�����Y��`�p{+��2�4�J���G���ԣ T�wldé��&�<)03��8��+��e+��� N�ׁI������+�A��>}��4��U�~vIR9 n:/r�����^����+��E4��eR���w�5g�1Ã����9Xk~ �>�01����TW�o���S(Zǃ��GP���[�#��_�4%v�J<�y��a8�|��;����]�+2 �\�n��;���kx*�5f����,Aj8�Ɔ�U���ξU�p_UWP�?�I�b����55$�����w����]� 9��z���� ��룜�~�x�yj���g3�������x�j��]�k�o�#�d�a#�np+���<8�9�L}���9;U�"Kk��u� �Xj�s�<d�y�؉zG�JC~��~�s��;��Ԛ &�����!��Yd��g�F%}'�/ ��S�i�����t�A��������z�� ���H�F�v�a"]+#0�A�I��s��AR#���D�����X��R���18z��{��A�IfPrH�xQ��� ��7�&�<p_��������������������w>8h��I� �ү�!\'~��=�-8��Ϟ4�-4��uxi"0 �?�H�J~ڡ� W��X��I�LJL%E��7����L���|��h��Д��y�ܹFdw �y� S�b��n+�K7V�,�wNe�����|�����\� �t�ȄK1����^�t��2pxΦ�awG߄�6����6e⋴uL^ �m` 6ad��"��4��7�I��D�r�'4���ED�O>d���F�]-+Z>�y��UQ+c��vZ<��.�&��K�� ?����A�?�V��i*��������c���F�-�}8j9} }�f��4�L\��#�WV f��:���Y�\8�������v��+Sq���i a�§����c�����D5�L_|c_ĕE��{�3�昣b�[ҟ��GXZ����/���#_Z�g$۽Iy~C�k���A�M�><��y��a=�c�k�ҁA�S����V `y� �S�fs=�v�`cZ��Z��Ȟ}����K�6 �.��B�'e��=�����F%�Âͣ�6��/�Au���@ϳs�]����T',��vS;�nZm�p7uő�;)��P���JX��� aB��-A���9t68��������-�f�\��bC�p_��Ĕ6t��@%�;h�������8p���d�C��E���Ȭ �SR]��) x���3��y��B��Sl�]�3K�Q�`{�o�Mm�6i�6"HC$�8�ɜ)�n�(b:ŀC� x�`Ϻ�'�.a���)$�b��I Y/����ҹ���H���M�5��9�����7���]���go�T��1�����_زV��2�q�o�T(�zz�*�[����0��͍��Z�t�<}W�t�A=�ۈ�� >>��tHN{��9W;'`����N������;qΈ1 �o�v`����kL�P`�80i��D�𝃌�
Behavioral task
behavioral1
Sample
patch.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
patch.exe
Resource
win10v2004-20221111-en
General
-
Target
patch.exe
-
Size
2.3MB
-
MD5
fd46256d85eae7208c1422133c31668a
-
SHA1
6f6fe66810bde87c94ae008b0094dcd8963a7614
-
SHA256
9c8d6f1647bfa23f94872674e04b314783038c31fd1db1bc3535da5ac789ba4f
-
SHA512
e108106ec8245099d88592b759fb136d3ad434151aa17fc0c544aa070ef87fe00f6cee0ce4de432cebab93a0ea045b95d1d572fe6cd15bb744fa9639d5c6bcf3
-
SSDEEP
49152:mSBt6pbDtvAgwSBl8YJjm1wXghpaFDL6rI3b9hL/TVk:mG6pdZwSB+YJjm1gE2DLICj9
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
patch.exe.exe windows x64
bfc94a63f2a682227d18e9dc2db097e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
shlwapi
StrStrIW
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ