�%V��l0��9r�ٽ��n[] ��~�ϔ>j�ֳ��X���l�%�Lj��+�P8\o)������N���\ȉ�;��h�3�S������3���Ol<�s|CT2�,����"�N�t��P�C�X�`cd^k>F$�8;�ð��Sh?���Rf�'ף#HH��)g����rz2I��g2T�H��7��Ia A�I4����u>�芦�}�?r�(i$�T���H��f4�Hߨʺ�&��x��6 ��\�6���A��'��൷w�g�����H��m�u��Y�V��uE����s�u+ω/�7�m�r����4n]ݽW�I6���3��P�*̌nyC��!�S#;�����w��W:��#�#�L�+���/Q�/V����)QPw@�Έ/�����uBcVA&t�ژ_��3���e���� �u�Y�������<N���e�,9�1l�7]���C�'>�z�/|uJ��U��9�;�����ڹ�RC{)q��g �RU^H�����I��������t_�y�Eb��6 HA*I`l�k�����9/^�� �5�GZ���N�aJK7�^I--�2C�̤Qs�I��Dx���B�;��r� |qw��;�xyt<\�7 ��W)��|?��Z�[���,�I����QCk2�xW���k�BF7b5 g/�u�nמ��2a�K�ns���0UtM1L8= :��j�n�����7��a�����-+T xk�`�9���O\H���F��v ��x�� )R�qS�?_e�i�1�1<�NR�D]���{��U3�Y8Qw�|�v�~�<��r��0� �� �hkէ�>,�R"/s�a�&:M�4��]�fsҠ1���{�?OP!�8r�9FR��O���-�u懲��2�*t��d�7��+�.�X$����S�Š�to�l�:�>EUd����/i�ۮz�ÿT[��m{�J�����~�cЕ���R�)�qQ y�����7����r�<��GP�@�J5#!���!͠�G����̬��ɣ��� �?��K)I+����������}(=|�2v�3`���w���-�y���hN��D�����K�����w�3��P�iT)��\HF4���!Cc1=��x��±w�=K�$ �2aH�����k2/(��1�W����X~���@0�t���e�`֒L@�+FH�Qa���hu���TqA�w�� ��t��Q��c�<͖0z�kv[s�F�lz��c^��:��MJ����Zv+��Q}tܷ�0!8�������Ԧ�g��(���aFhL�\>��S�t��xMn�����SC0-���j�*"�z���i��n�XA�# ܉����Ym!��� 6�BX���-d��Es�P�����2��ĮFY�9�:3��=�1T���g��%�<H%Bi{n�_]��02����m�!�I���-"���Ag�MI}� �}sOK�Iu����:d�W�-�����Н�!?|%T5?��m��ڑ�2[8p���i E(�@{� 0ėI�&,��D���RX��E�`�C��z�*+T��5��ɒ i�w���F��vMi�=(_<�0g|��8��ȉ�����ð���f��T�{�63�!��������SM�W�ѤX�1ʲ�C������Ui�ʦ��@ ��^�焿ӛ�G�ļ�.$�˴�EH�s����g�~d��U3��R<�3�T�67��ﲚLIcF�k7��$A��%��8�`��9k��_��%���~�0��<�eڕz�u7�:�٣|�W=�]�+\+��d����I�}юfR<�6,?Q� W�]�-�b'_����3���q��{bȷ�t��3��w�O{eW��<����*���\$�G�w� 1,ҏ���lV)��"$J�?��j�1�1$[bjK}��aj��g����a���W�� i���4L���� �f��4v�R�q��� �-���rxZ��7Q�L�zd�j�y(�6��k��eƝ-v�d�B�]o�,��(��fLY ���~9]%��y��4@�\��礋P�M��˦��e��S���C��i�OG�ߞJ���m�Jo�_ę��9c���������.�'rIA0&o�<�t�t���V:��� (xm��]�j��Xu�/�s"^(�W��DC�R 6�h0��(���5.���@����9��JO�=��,�>ݙ,���0�$���u���9��1 �O'v��ěw\���b�Yךg Y�ڬl��b� P<W^���,���u��z��Ny�G}��`G��Q���H��i�U������5����}g8i8!#�F���Μ�;�]m��6b����b�2��Q����y��w%�S|��g�R����c��k:�E����g7�rGК��=[��>.���K��x����K�>� ӄ����ǚ� �z�c?�C�) ��57X/�? ���'��َ���r��H��\�\��W�妞.e� ����N�1��4>*��=A�UYGV��?�]��8 0�Ў0p�?�}_�=ƪu��@��A�\LI�L�[i�(��Y~��#'� ь����7��#{X�f�� �S������(���Ar��玞�fj�I88�6u�j�0�`j7�m��xd=\9�&�e��SK�п�U�*�ƥ���ܼ6ڕln�Ԕ��jO [��t�I��ڣr�� �@���&��3h~Y��� ��l����[��n�D�zB��n �fbX���r��-}d�-�e�WqyC`@O����G�5|�v~%��$�-< �|ƅl�db X��t8�8��]7z���d���^o��gS��vy�2���Jj��ۣ(�YQu�&�̭���5��~��I���4vp%�tl�����`��s��h���ف7v��Ln�=1��Ɔ� �c2�cL�n�o�v�#���j��DT�3��0�e��:c>��4����+avl�x.+��lϟ�`���^ ��k̗sйI��G6�@�os���K����D�����R6\%��c�9a,e�S~��]h��Σx�;MS�㲁`��;�谉���4�%�.�������-��P1�O���g�
Static task
static1
Behavioral task
behavioral1
Sample
rcBaz8c48p.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rcBaz8c48p.exe
Resource
win10v2004-20221111-en
General
-
Target
rcBaz8c48p.exe
-
Size
6.2MB
-
MD5
83f12a71469939b46829926e42de1e95
-
SHA1
e6debcb08ca48456daeb0aaaab5d56b74819cd90
-
SHA256
a9e9962333be5fa384c10bf0da9a70c0f44ed19dce8326d17a5be9c8400b7eb8
-
SHA512
0c363e785b06f636e4a19bd3a511478b2a63aa2ed58913e4fa4c431ce9b0f249b8e4cbf72540373d2680bf8ea44298a69bc5d5ec52bb49ee5d4e65b2d8c78068
-
SSDEEP
98304:wv6udgkq1IWjqDkmhffHWUoLB3CrhlvjnvLhIm9buiBqC5dZOTiziKoBu5svZ:wha5bOkmh3HWUoF3Srv1ImTaCLo
Malware Config
Signatures
Files
-
rcBaz8c48p.exe.exe windows x64
f946012b10fac82634aba6a3c002183d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetEvent
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
CharUpperBuffW
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
d3d9
Direct3DCreate9Ex
urlmon
URLDownloadToFileW
normaliz
IdnToAscii
wldap32
ord200
crypt32
CertEnumCertificatesInStore
ws2_32
sendto
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
advapi32
CryptDestroyKey
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.(u/ Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.F%d Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uFa Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ