��k�r4v����W?�nG�4�܁�¿��u��%Z�,ZB/WG�7�+^����+�Z4�'�.����]|����/r gB|�G�*;E��Y]��!4�Ep8�f�z������֞�A�"S$�� ��\/�z���: J𗧰��gyFS�<��SV?p�{W%��p'D"Bl�;6�1/�sVv�9w�ڠ9<� y`$ˬ.q�bA2�y~��ijբI9]��T���AL��d���20����8f'�����WT��]K�8r����$ow�����a��蛵�]�-h(��7�qt���R ^�ۀ*��8I!�o�o�FEj�<2��t�-Y q��~��r�8L ��s�?8��ӛ���`��F���e70�SvE�Q31�[�ӫ��q�Rg5W�����b֣ʸ�'��'$Q�}��>"��+H�h�V0��3amU� �_�"����Ow��w�A� �i���(W��o,**���Y(�`�a�Q~`q���M��^(kD�ցɎ�3zcyO����T�)%�B~�DBH?�*���p��%q�I��L�7�a���"���%){l�7o���#elѼɳ�^:�����t ����}�Ǡb����ƄD/}��o�O�D��-Ֆ��Ph�Cj2t����4�H�xVŊ���(��u:��&X��4qT�s�DM������J��u��V@!3�;"`ǁ�� ��6�:L{����&��>Ldsa��]ͷz�S��tEo�j� v�%yFj�c���o �U�|�Jk�(�k������ax�vb���L� ��gC��sN�z�����ew�����"6Zl{���'���.F�^�n�_n���Pjք��{FX�&�Yꬼ�$��� �2PG@I���CM`O��7�W���ٳ �v��**U�I�ŷT��<�琼:�B�ڗ��4爈jE�<e����F�x@���1��'!գ���V���E3m��gi W!����J<YWN�ݶ-�����)�uNV���g���KIxF�����l���� ?���x���p�����(�խ ˻�I����!T-xJ_�!듯�3:W�Q��J����V�b��o�%~h��U�0V�� \��Ek"���=�TõOU.u@���/���+���;���B�o�� �6p�2�Λ�N �q���i�t~�H�%���f��B�7�K��?6q^Y{�<��K w��J^�9�^����|f����m� Cl���C��Fw,p��^��=� �'8���OZ N#'[kAT)$��U�~RPم�p h�Ɛ�����gGm �9KS������@x��~Ze��%̀��p�@�?��C�H��g'���O��4�#�'�>���ћt�/䈞&��֢8�A}�`����/�-J�3Mi�vݍ�rI��]�RX��x��{=6.x��>��M�U���2��`��\��&Z���-}?�eF����0ˆ_t�K/8����U�=�-�(<�;�����!��VpI��+�f2�ڪϜe�T��˩��tlS���0�o�X�w2����1I�hHf����T�M�_/8ᱺ�K]JP���jM�7z0?�h��=��h�d�2�U��`�����Os�Q@.�3���+b�)KaM��N{=��=˲��[BԚ�J-XM��i���(���33'�߰��h�I0_t�N�h,�4�Z�u(��6����-)�i:�CÖ �O��zck����5�i��҂���Ya]P��z�(zv[�U|� ��m�h ��9}Yg3�z�����l�G�f�5�o�~�:i��(Y8�B��Q'��%ʡ|�d��d��V��S>����#/`���+��g���a6��K���skH"H�#�`�CYr@f�_����t^ؐ�R�8 ‰�7Mghz9J�����Z2"Y���!%�V���/n���wۥ���'�� �O����Y�_�\�_s���Z��������s6�Ż?�����g �Ke��rH�3�o�a�{�Hp�>�b�5ը]�F�z{Lv�صV1{:�����Xr�����8\,�9�~t5��X����SNG)�9�3����� 럠h�X}Od͔i*;p���%Yޥ��a��� /O�䋦p5�>=�C��He�j�w&R��|$��o�p�xVp���a�&�塒��q,�̡w���ˉc���q�\;h�=�5"_�>�C���f�vc�������!̚�&�0^C`��7���^�U��l���y���#�E�aFR ��_F,����5�e���Q�������#���&��'h�r���2^���8K��z"Q�`�or65 0� �����'n������ܟ� ���"�C�_F�>(���X�5=�Ee�~���(���Qx�&���uK�)V�������c�t0Io�v��#Rx�=2�!�N�?�yI<{�m`�ؖwH}�r�5N�EC��@d1�d�j�#�2>~�����vL��;aȉ�Eee�% ���9���y��Eܧ e|W�=]�����ͥ+�����u�DZ�maF��[����v�������!I�>(`\��X,�>�pN㛷��x#��n��=:+�4`O��|ڑkC�_�z���^-6e ����\5$���{h��v�,G4G�������b;��+M����zT0���[!�u�L5���\J�z_Z|����Y,�y�����o� ��-y�/�J?�"��K��\c�2и�$T�����h]�@��<�����Q�:P��$�@�"_6�'�A���������H(�.A�i�C��A���f&^�l��}Q�1��P�����ABՠ3��2��V���3��mn�tb.v�,!����ܼ~PɢI���-'3��n^��5%U���;7�����G����;)P�Y�;�0*�G���� �^��I2�������Æ8�%�yGc)�v�|��E�6}�a�6%B�p�uT�Բ��Y�)!Fv��7�����#����<b��5�4�s�����[uK��mnB��}�:��yq>,��(Q]�w�@�����y�M��(u ��e�/�%�)H�}�5�V)�e��x��囎���+�X��
Static task
static1
Behavioral task
behavioral1
Sample
2wMtfoIFDv.exe
Resource
win10v2004-20221111-en
General
-
Target
2wMtfoIFDv.exe
-
Size
6.2MB
-
MD5
3fdc8b358e942213a4bc90896f3bcaba
-
SHA1
a574afc89311b757032a47ec3bc52e6852093e49
-
SHA256
c556de05e254529d33f41e2d014efa1c332ec9305a50d9d3b66a045b8dacc20f
-
SHA512
ce803f9cdb2720ab2d422601554343e97504aa29e822d229efd057c34cab3e344e30e30d0edf971b5e006234b662d63c29ea208d7f66d3d40d5490cd5c5d3482
-
SSDEEP
196608:a8DuT9OhBF0M6oqBWW4OsfvY4IqIHfuWW:asu5O3/6fWWUneu
Malware Config
Signatures
Files
-
2wMtfoIFDv.exe.exe windows x64
a36611156875a80644b75bfcf0f0c335
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
shell32
ShellExecuteW
ole32
CoInitializeSecurity
oleaut32
SysAllocString
msvcp140
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileW
ws2_32
WSAGetLastError
ntdll
NtQuerySystemInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
tan
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
��IV}�n Size: - Virtual size: 641KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.�4P2g� Size: - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|�� ��< Size: - Virtual size: 610KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�Ag�~W� Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
��I Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
�x*!�r�� Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
"�D~T<x Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ