p\� �W@���.:��J\¾�k���Nj5�σ�L|l�[�[=�������)f�`�ژ�����;v5�G; s�o"x)A�� �h�Ę��,!��y�N�����nN�U��i�{��6���Ĕ{��6mC��$'�1K�ſ���̞5�@<9��Me�|q2�&'�h��ɸ��SD&��f-+\����ϰhS�`�h �=�L6*�YX���Hy8P���GD> L�3�Z�sw[EP}H!����=����C~6):s� ��"������@7����k�/�%_�=`�1ܐ�>(��D�x�_�j���Q�'��m�?�NX�W*/���eV0m�Y�b�0c&I]�q�"�M�����{ǑI�<E�9�2Ζk�0$���&m�9a��vo��H�eI�=?3 Ń��#���A~K���X���� �����:�W���?�%�h�� �:U$���]�mj!<�d��½KF��c�W&�9h5�btW���\3/pFq?F�e-�kߋ§k��y�'䢽��_���q�ߌ]j2p ; �2T� �U��{.��E�%�*�F�ӗ�A%�����8�z�j�s�����úct��b�%1 �����(�*R��<�m�+�Md�ݡ��n�zy�x������qo7�m�7.{��PHD��WSО״o<N�b ǝݝT�� D������X�`���'D�YS�8�j&)����Hxޒ�`��a� D��Hu� x��r�7Lyʶ^���M�}��VL}Gϼ��g��Q-����}�s��o����8��&�$,�S �o�HAn�;��p~\�~<���d�D���߆>>���ѽ���4|� 7���hz�K��?���gX��P�"�{��VTC��`���*C"����&��S�r�=92Jp� ���|�b`����f�������ޯ�ڨ�З�S�S^�w��S��!,M��=c�C�� �y,������\�]�ED�~�Ak��� \�?j�]ꎬ��ڛ+}�K����f�w�TO�J\dȗcZ㴍#?��i��S�G�.�D䪝 ��P�dQ��2ҝ�X^��G��\��J�ܩ6n�0��.p{�5��^tƻPߚ����l�RDGe�J"�.�4�(�'d��"�ݣ������tm�WumFKa��j����b����s]��0Q�G�8�$���8~P0���T���o�p��v-V�jhm��F�^w�V���//-d��� pn�M����i�h Ѝ��4�d�(�̰���ߧ� 0���ݖ��.��$'�]\[5����ZaǍM���\��[�`:�_k��yL.��. ����ߵ|�KWb^^�E��/#S��} ��Hj�O/�#�ԩ*+�B�����5F��y�2�_3ElwC-�K[g�Z�)���Z�̨���nbT�C`aϏ������P�hf�� K���C��pb�M3WX@���3�Q[�w�f�{���{5a�QM�N��.��ٮ��JC�W�&c6�����Q�Ȕ�7���-�D/5�:a�sb���u�+�%����������|(�g<R ��\���(�Ɏ�o�:aԓ\���L���=a�O]K�6��p�pS��V~tp�<Ͷ�~�iL��1)�5OsV�g����� ��n�A@4@cr7���2eCj5��\t��� ���uԺI��ڞ$+o�)L&HN<�o:�5Χ�mm�l6eϙ�Rx�����ʔ�4�-'�����L��s��*8� ^��� x��D*]L�������5;H]N�buk�5�8<�bS�Du?5�.;�����IX���9�8��v���&G%�0T�l��dg�*��uH�)���O�:C�Kl%C ������~�~�&>u��𦎂v*j����x���_�-�K�;�!�pa6�$�����R� ��� e��]*�r玛�E�/i��z��w'(��C��f<&�+<�� �����]��H4�O�+S�AKX���QuB���|{�˨8�������;�!mT��s������ag"�����R8O�*Ԁ��&�DH:ihtV"&��o���K�^�t�f�'��o����#)t�lP_�V�!�r8�Qo�����&�S���(D�*ة�&�ZX!���Y]�ѩ�宖�P�|����J'E�{6l��,�)\���Aɷ����؞�9}OUmf�_G��F/�!y��ghb��ka�斎}F�4x�E����X��cM\`r�!7���ټ�����nw�/�{�5eZ<r�BC5 y��q5A���t��"�8h|x�anT���t�N;3��*�������~t-}�#����%J���*��'�F�J�_2�������&(�QK��i��Q�TJx��qI� X^��_s�?�Ğ�b���I�� m��̹�j�DM�W`7�7J�>T�~/L�{R�@TF��+�h{��X�Tuq9�mT�\���(�Y���HǕKy���g�~�e���q���'�>�U��K��Aq� ��L�=��|:!8����~���U�� ����������s��֓�+?FA�@��Vh`��xRfP��������=��<1K�0ٌ��eKq�?�~�S�4�gʯ;�q7Qbi����pF��X���ꖶ*d���O��Z�/�q1>8�_1}�������g�$��om*�0��p>��܋�>�.�̏E�=]C��܄�k���=-�^��'R��Z�>O�P��1B<9jLW-�Rc"�D��j����<��怬E���D�O����d���:�X� v�����p��N���͓�$��5w_C�b��M-�}���<��w�FJ�: :\��fpH�952����&�GDŽ�a���/F��u����U_�,�~�=O��Ex���~��3�j.tח8���)(��x���4"�^�SL{�Z8*U*H��^���F<4�5���� C������9(�ZX_������P�Z]{TlF�o'y�MQlf�r#o��p�,�b��ou��d������@��+p��F-��4��$�s���$�l����U� �e�[`�c/qA��%�y
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10-20220901-en
General
-
Target
svchost.exe
-
Size
27.4MB
-
MD5
070eb0289afef7856f50fa63e7ebde87
-
SHA1
caa97a34ac8e4a54a62d525b3d7cfda167411d0f
-
SHA256
5921d1686f9f4b6d26ac353cfce3e85e57906311a80806903c9b40f85429b225
-
SHA512
e65e72f14483530c82539a7b911efcfd56a2ad34080c66ae55ba4aa303a5716af1b3190fc618031275076a7c7c75fcf130a2fbd84923cce05d1cca8634a088b1
-
SSDEEP
196608:bmadi0eYuxM7ukMfqaF/3LQP7dCr3dHcsPclX9ZDWiS:rQLYWM7dox8YGdDWh
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
svchost.exe.exe windows x64
426ec1f9e7b1c7a08f3432fc4e11ab14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 730B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ