��,{�/[GrI�ZX]�#��w�fo�����<�.��n�f�O%�㤀�ê�VKS���@㶾I�Ú��U�+7�%ٻ�^T5CV��Q��Ob�@-��d`�[$�ws��I�~h<2��=հ��5�B�Ԙ�@S@�I؇�����0b�|p=_�(��U�&�wRN,@mO*@�-��'���:�����������e����I�C�ޙak��B�[0F�~C�l��Kl�M��|\�qd��A.N,?���ܬ?�첨}j��0�C�W[U�e���� FӋؙ�������Ck$�#�VZv8\��3�ॲ�N,X�8 �|�M��p�X�:_I���6�0���5�-@��|Uo�B5��c�SMj���u�g�K�e�'O%�f�R���S��YC�����(h?�}��XAx���x��n�z{l�T�+6����t )���Fm|�:%���EA���;G��r��Y���R�����4������C=`X[?��|W��@���2���.�j,;�D>���.��u�4�~ū�>`�@���\��y��Ȉ,js��f�ډ��Gx~�촾C��GnطE_Ƹ�k&�+3��-�(���~=}���x����%#����^�cg�[؊0x�0�J+���ÇB������@�fO����P�a��4��,InV�Nl�ހ�`�"�9�U}[�N��A�n��85��=���+�F��zC?��[�v�ņ���!���3-$��hv<�"G�:��S������̱��\�y�g�L�^��\*;sF�]�,���V��7h�%6�B���(�*�qS%5������-�ZGi���|����:��d$�U0��=��3j�:�nM�zqh�F]������<�j�µ�F`Օ���g��,�Dl������2� l�)���x�Vh�o�S�m�x~��%��-��i���&�[$?�_�&$z!���r���Bm��\����>R�>����h�Q�h]�P��0y�0�3/M}D�m=�p��ܢXoS��K�H.���˔^�G������Ʒ��f�O�'g����\E|=Q�D��lt?^R�K2n4��ߛ�3.W����GVz��;Gt�^u@/,��( ��]��qM��+(� #0�O�s7�ˡ� B� `p���{z�ow����t9���,��;i��-��zM�����5��N��hK؟����y�-�F�1���m�6h6��&.��~_Z��DP@:Y8aoq]��"J2]����濷������=~��I[���I�X@��kd ��&�RN�_Ԝ����~A6"4��+*g�FLXkks�4�+b�>��*;#"�u� ���0��(�`����ķ���=���� %6ʃN��eD_�F��0�����ٔ���zx]V��_���TZj�m��U���{ ���=h�����6/����o(*��/$����5����đ͔N��B�F�n?�������OF8��<<�S�[����~���xU|��>��S�����m�Οg~��f�GBy�i�C-��R���J�0|R8J��&��C4�R�Hl+�*V�]^E�T�,��z%�ߏy����n����0��K��=W, ˆe��Z��`K˅_�$�ט�b�b�����o?��c%�u,��!º�a���S�!��O������I"H���HxM���E=k���l-�紑�� D�mH��e D���0�!��� X1��$���tm�ß�\s��z�]�� ��)}������k��<�Y��s�=:�u)V�1D3�a}pK���:7f�����N���{Lʦ`��������΄��#H,mgpwk��7�������ÃG�J��X1��Z�i�V����V�GaL��9�pu��v�: �-����M�#��ƞU�o!"$��[_mf��*�wQ\�O������@{O�f�?���,J:$*>�f�G���Ƿ�..t�5ı����ўq��b���u�cn�xBb�C��"�`S��l�E��*�g0�.�AK,Qi�D&�[�E�,%���R��C�����`O������,��0*��Mn�� ���k��P�Z5�ϳ��&�]C�G�f�����P�q�A�������yw���?(�T��,�^�*h�s����U����6�����7�&_]��#��Xq:���}T~��Rn�G����¶���L��@����e�б.�zO���ҧb��-��e��0r�@ט�`�ԍ�����܀m�KŢmc�(�j �o����R�*��r����E��B�/p���L<dZ�nMbi7� Ԯ_�9��1ťb)�gf�7�E�}�;���QX ��MQ8�$����H5L��Qs8Ŭ G�u�o��m�G�i)�ޙT`E��D�T��!A�;jo�C膒N����M�a�Co*<��d�/Po�[h�I�}R�N]H���ª�F����&�e{Rh��TE[�34p/ʍ�������������kw �2�l�TB�esbM=��M-δ���_��L�2Ω���F8S>Z/��JV��:uQif~��ZŖ��]�7��ٴ��Jl�ҒOʕ�X�A>H��ۑ�e�z�"��օ�.���܆('m@[���{dL��J�L��l=��2���l�^k7�B|L�b�����X@�9K�x��<j����M7��5o��?d����y��(1b�����7H����d0���o��Tr�k��c#y߹o}u ��u�b�QB�O�����4��)?�����C<F��3��]�&sS� �������Z�D��w���~%+������]��E��:ĥ�^�:�Uщ�C��Hm��R%}�j���`��*�L.�Ǵ���M�D'� ⇗?�K�B�52��nj�O ��v�-Qi|H��3�b�tu� �Q�S����yo.�na�j��@k^���t��.���l�AaU���.:��n~E�����Z(+���V��ɚ��mǫN*�ߩ��m�����B��,��'R���FB����7z"̽_��HE ��L��Еi|5&�;dG��UY���z]^�<$hL
Static task
static1
Behavioral task
behavioral1
Sample
mta.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
mta.exe
Resource
win10v2004-20230220-en
General
-
Target
mta.exe
-
Size
6.5MB
-
MD5
5997ab2d95bdbd9bef2d00e6e66a9cdc
-
SHA1
55e023a62471d2947d4545f596d9a7b01d6b450b
-
SHA256
7304a75a79681e7fd84a7a625df44683f5a5318ab933352b55f7482c584c6551
-
SHA512
afbca9ef8601a9fbf407d12b3a59f642cd43ad1596c958a9c4edb8f9a62dc2878279ddcc5c4d4f5bf0f5529b580ff2e5b93a86e027ac4499e3e22da7093efb7b
-
SSDEEP
196608:mue13vAn/lYl0tA0sE9cvT7g0eOMdNAv2W275ZJ:muaAiAb9crc0/V27
Malware Config
Signatures
Files
-
mta.exe.exe windows x86
deb7af7363f6e33283b073cc13cd1ac3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAllocEx
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ