0����� ����qX�pl���k�tˆ��~���Q^�QȻ\�f4���4`�Yv_Eؚ�V��<щ�f�,om0P���o�ym��Ӟ�J���P$r�ĤQQF�n�.t��D��������anPK��{8ghCG7�ac����*r4�P�H��S�{3*PW�A�IE���t���x���E�,�I����b��AS��n��g��0����橝��Z���`�1X��m�~;���߅I~�v[ ݲ</�� 6:cq�۴��� ��Wz���5g�$�HP��D#طr~�� �@�Eэܪ����'��qds��[�~����^Z ����#�� 5FҙŰ�MN�/��n �mJ��{�B��&�S��m��W��6�L� +����$O��.`5�'\Dw����v���o�<�{�z�Z�L������5#"#{�Ũ!��[��M8���Qޱg��?p*�����EQؓ+���[�W|b��-Y��]��Г�A7�0]�F���P�2�u�e��ɶ�5�w&�Y�nbҔnň7�V�����R[!n���7rx�(���9�ʈ߱��[G�!�d�䢪:���O�X�hR�p��M�� �U�7�YU}�H��(�}%���f&v5��T�o|����e�^~fax�Qe�ցGW��z�~^R���e� K#��rT�p����q7V��� ��+H�h���c&Ck�ǧ���{l "��@����o�����4���z8�u���d@ ���[>�"��� ����� ��Ƚ��#"�)Hew�aIC��K �tENa�I:9��<)ب���*Z'ps����;U�cY}�F��9���C��6���6�Z;ď�ar#�h/��!��T� `� ��ds ��W���2�BS7�.��������lC���Fq�tkZ#1���(�bu�j��A�Rpr��'}B��:l���DZ��<h��O�Ze�_>֟8˄&3�����>�.�k��b��ğd(7|��-��R�;V��)�֫���Ux�#��.`Ⱥ�Ж � ,76�D�M���;h��C�ӫ�:��w8��{p�z �����H�L&q��~*�m��AlZ�26�K���@f��g�p��[���wK��*�ț �N�rF6���]�v�X��1Eu%�)Uۂ7 ��!�N?>�/��+X����[)G��vJ��RjZ�zx�������ԝ*�wL����'��C���B!S���d�����V �� ��p��¹FO]�#N2�F��� ���DMp;3+�4��j�UT�R�L�;������gh�kWvG�r��5>j#>������#��A"��T�����W��)ۢ���=���<�A�㾢�F����ص*�a7�ʖ�K,�[&�-�:CUʏ�D��E�����'�o�O6��G�?V���ٺ�����PH����7z���Z\i�Rї� �dz��U$cxu�w�"u�CoR3�3�-��]�ꩻ, �M8�O�$���"��C�fe��څȄ�(�8JH4v��JSL�F}lB �%�b� �I���l��4)tc��g#@L�|���S�S���oֹL�?�k���24��U��h}�E�:级y^|�L���׆��TW:;#�j� ���Ž�+���D8���:�8{�|.�"k�THY�� %Pl�����v�C@���KV���!�DYP�G6�nr�oi�T�Kv�,#������H��=���(5<MRS�W�L�qڈ7�J�h`Kw�����О�?,��5r�\>��O�<���{��Î��F�GJR7��f�O6c?�!̨��-J�S� ��Ж��uI���C_���I��Nh���_�=��9�N� �+���,��\N�F ����KiRA;�an(#�l�9d���HL�q}s��Ab(4&2�M�kPm��Ƹ?��8�ۙ��NM����ľ�$��YsI��'��~���� �� �j��⛾C����|��K���H��^�Y��`TY��h|�� vc����A�Q�a�;�h�����>�)1��(�uo���Ƹ�� �tꌀ�y3���eڹ�6˲T��9��h��K��,���o�*�@���O�n0Nx iu";���K��X��P�'��v~QU���.���<�YU�[�z�RgdztZ�Bgֽ��PW�O���[C��U ;�zl{�jf�1�HF�0_ԣѲH�SU�߰�D�j��>|���\Z�8! ΙV+|Sq�邺��uSC=Q���0rݠ8�x���V�H���;��pYӢ��m��g%����5�0\ ��x�S�vD�"���bb�N "=�>]"1��^\���^xǞ�N�K]�3�O~��G�����r$^Qj�]a��~�Dh���a^-����E�(,[k�A6K�Kcт?�WgU�V�YQ��3~�����Z����ƞU��m>�&3 x�%��� �K�0P�;쬳:���n�%)��,�o�WzA�.���=~n@m���t�ܑ�݂��.�c�����.C�����eڃ�`�6���؈$�U��_m'�-��Irl�ulk&��4n����o)���R����\*Ώ}�T�왩aL,h��A������R�У�xJ���"�M�-{���>[�e�� ��F�Atꍨ_���3�#A����� �w�u���P�� ���{����E� /E���}��s��b�I����ү�Fqc���YD�ʘ�0gF$���?�c�잒�Dv�ؔ��$�ZL�C}��":�����(�U x�8CaT9� �"H�ᱏ�c'V ��h���-���(�� ��Q���>]�ؙ}����>*�=Ha�[�WS0̥p�c�-��E[h��x8�RQ�����%-K�D5�'�f�s�$C[��7Ҋ�*4����.�D��8�r�2�]@�`�9K�M2�1�@�:���6�s֑I��ֿ�Zz��L��+%i<�v�vR�-�ͧ|Gf�"�1�����xXId��L�ы���+ Ez%:�_�_7��˻]^�w@L1��*lg��'e��:?b�Jak*���9�:�������2��0'xV��|��!�ىZ��pR�k�<ö��ڽ��2��
Static task
static1
Behavioral task
behavioral1
Sample
srheageg (1).exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
srheageg (1).exe
Resource
win10v2004-20220812-en
General
-
Target
srheageg (1).exe
-
Size
7.7MB
-
MD5
7d316651b40a977ed3a443214e85657c
-
SHA1
8d1910e9db99bf2eb5603d2aded43c340833602d
-
SHA256
70bf448e45622a3c5a3552a34de24339c089a5eae7152b4b9e28bd2688ba03cf
-
SHA512
ea8d99be82826c12b976b8ed37825f423002a4f25dd96891b10829ea4e7cb342d3322a9824a4315b2eca9d1a67b28ac384dd85f6484c76726ef325fe986fd882
-
SSDEEP
196608:dMIRVQ+KOAQPpEtSZyV9AIEWOKfxyfvC:+IDQPOAQPiSZEV
Malware Config
Signatures
Files
-
srheageg (1).exe.exe windows x64
bbf486696c39ab79f3be49e7eafb68e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtUnmapViewOfSection
kernel32
CreateEventW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MonitorFromPoint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
comdlg32
GetOpenFileNameA
advapi32
RegSetValueExW
shell32
ShellExecuteA
ole32
StringFromGUID2
gdiplus
GdipCloneImage
shlwapi
PathFileExistsA
setupapi
SetupDiDestroyDeviceInfoList
iphlpapi
GetAdaptersInfo
gdi32
CreateDIBSection
oleaut32
VariantClear
ws2_32
getservbyname
wldap32
ord35
crypt32
CertOpenStore
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 791KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ