�%f�b�"�8ư�`'l7�ɶ�ؙ����W`�a:H�Y�70G� ~<Qi��օ�^/�;��zq�+J���nm���@�� Q�X�J����o��Է-i:bK��6wb��,�� ��_�`N]�wi� ٦��tB��<1nF+��4��a@����?�����e]�s97GL�,���JQ/�H@��q;+��M�.&�/�����+���k�'�٨3����⌭|�\�Ix"�F�P��x�9 ������!���2����x��OPOk+W���A�1�P���s8�#(w�A,��)��?���vK� ��b��Pq �l���$�A��^����ixi&���0\��Q��Իq.6�����������e��=?�9���I��NC���U��g\�p�����ToH��h�͏�G����̆�elj�яǁ�1����N��7ᣓ��/r��;�� �]���&�2���=��66�V�%#R�N͊���8��#����l��˒�U_)MQ��~G�'?��a�>Wv����<���{�5�t����O)������G6���-Nfi|��υSE���7�� ]��a�r�9���1���W��g���[1�#-��X�Ŧ�S[�S]"r��)�a�#-�K������I�x�a� 9�7 �؉~���m��B`����u9ȅeD#��t �t�r�%�F!�_��; ��ʇ<^������U��|_�3r?,���[���Zo�d��Yڦ��i��C4w���v�ڶ��!���χge��O <�W��6mx�]�y���)1�1HU-��LK��9��y������V��G��,%x>� 1�>Q��̀��-%�p���ɪu�f��9��!;bW�ƪ.��I%Suf���nZ �zFb�3���=D�����&!���]�/���Ȁ�X�U��� u�2^' O��F��x��f~r�:������Y��G�V�:^F4� I��ʫ�<�G��7�����Zu��&�h~Ț�9ry�Sݪ�!�I16��2�� ^X����c�C�;�� W�b�NI\�Np�0240��j^:E��i����_X��$9�lֻ�vѠ����& b]Uz�H˺���*�̤�Ū�����ϩ~���Z��i�7%99���up,x@"� �x�0r�^6S��k�_V/7�fG�C�E܌����� A�B� VEG���6�&��bU����e�H6�(q����DZV���}8�4�*�<Bi&��8u���ψ�z� }%{Kv.�b+d��g�4m���G��q����[���4t%l��a�3W;�7������ih4R�����N�u/�;o���\�f��!��8{�c%"�7�+Smx����vӟ�QXRք�OR��)���9L����8?S����N`���"�=y��%2V������pn�2d�l�jh���va��amţ˴�Ty����87���ĉ�>qo���Nг�/S,,��)�aG��Q(}IB6�)�s�Sm���鯵�B�؛'�|��[9�?���C�a<Xl 3A�=|�Մ�ɸN̑���8�Q�z%��K���YC\H�pA�K�TԺ��S�>����J����x�����C�:��G�Z��Hܛ�I�HC�D�L�� �5K�G��O��D�|8�b1��ނ�ҕ6�κ �k�8�@�m�[cN��=�[�4;Y^�z۴��dG O�Hn3��Sȹ�Ҥ�"�����3��y�X`��m��l�`o�^�l���[��ͪUQN�����I*<d��5-��\�Bo0!�GK`tއx#��GUI�ՋZ�������ME>��.�Qq0�u��q���t����JW/ �ʭ�:��;�=�d+T��k�]-��{���S�m����&���Ï������^�7�,h�� 9�ੲQP�<btz��$�A�~Y�3��|U�g8���nm_(��W�m,h`���H�"��z��'I�@"��#�k0��w)�9��2nt��XzFo��B�u��-��������\<�)04EJ�av��k���c�Ճ[q*5�)��̻t�����qx�C�OnjF��$ph𠭕�k-��&=(X83mϨ�y��FB�o��)C"����0.���[ae�5�������Ο���8ӔS��(�q��x�� n�<�%���iVcQR�Ѽ�@��?����KM��C�q幌uwު!�.|�}�%y"�?'"{e���,�uT���oz:���K~���O�UY� R�i���Hr�K�j ��2��.jˊ��!Aɂ����8��G'I@ DUU��B����{� C�4��9�j�5���o���K��3�4���@� �K�_��^,H����빚c��\�g�����o�23ױQq�|��:�E=%�J���4Z�<͑MF���L< �q߯��(^g���?����&�Cq&u]ϱ�wCQ�������N�ռ�g/o[G�u�fY~3?���r�f2 ��ϯv�E&&�z�֞�R;Ҧm������u�G���{Ģ ���@��t+{�},�AaP��C���I�U�CL�ؙ5 ��������f��;��yƤ}��eb�����z|��`^��%�K�>V�B���:/gO��U�8p,�o�V>�d����Һ��@��(��WsBv������İ z�Ћ(URb#����$Lҗ��Ɠ��yO�/�qc��^ Nn>���U5��Z�i p�����'����#$e:r�E����K�&!�+�x¶����_q�(i�l����"ΖAA�r����r��0h�����;�`�82�{�Y��.�hx?ݺ�Ō8� � �Ă�INu[9rN��FM�Ivl�d�D8U''��ʇEg��45����S']�mrMK��}���f3�3�i�V�gz��{�].ӡ��<������4R��I-��0O,���@%>�G�9mh^(PyL�&�=�_*'����I��\������=ǔF5z��N!91�x���K�<T�������2M�2��^�b�����:ݡFSaH�����sOD�+�4;�Z�)��Q~y?�����)��%��${�"����+V5���(i
Behavioral task
behavioral1
Sample
ch-ragnarok-premium.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ch-ragnarok-premium.exe
Resource
win10v2004-20220812-en
General
-
Target
ch-ragnarok-premium.exe
-
Size
6.9MB
-
MD5
7cb20bc255b32ba7aa1ee037e9cf593e
-
SHA1
9ce8cc73cd0994408a094f536834a2ca6afed2e8
-
SHA256
482b7ca05112e245281d2740645005709c943b9ffca756406847c3c4a1b1127f
-
SHA512
d4ed219fab787de23eb5a7c693d92116eb6ecfadd11aa366a39c7ec13750342677a9c178f6f4961fddce71b7218283628e051b212ef6db36d2564859e7bfba86
-
SSDEEP
196608:sdXChFU7shKrRRLghGPe2yfQiENYOkmoxTllVbf7qJ0Lw:sdXCY4ORLh3yiNLuN1q
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ch-ragnarok-premium.exe.exe windows x64
aee62bfef996f1aa0403f237d3e1c06c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenProcessToken
kernel32
LeaveCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleDC
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
xinput1_4
ord4
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageA
WTSSendMessageW
rpcrt4
UuidCreate
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
ws2_32
sendto
wldap32
ord46
crypt32
CertFindCertificateInStore
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 875KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 671B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ