�v+F8\F���oy1���B���FB�`5ݨ�u���'�l՜�Q�bC/]r/��-��������^��Ǿ�S�s���5^j�m|��WK�̌���g�v%�\�Y{S֫K����d�!풿tDU}��t��+�ݎZ%�I��Լچ±��{�`�T#3 ��{k>�ֺѺc�w�)��/2�m��fl�4!��gN�8F84�'l�r/��/�p/mg'�;(�q9fޗ�3���K=O��}Z\B���x��.H����w�f,A`%$ZAG����l��Gȱ\�s���dGQK滠l�pp�淛��ft���h�RZw_�A�C��N�T4z�)�'��cT���ឱ�K�V��MJ>`{�u/f��x�V��Yk���N@��ñ1PrP��#Zw*�M({5��n��9W��ZO|�d�g<�M�G�+����L�u��h�gau�v3>"R�?;�ʷ��O����dž�x`;N���>F(�rS\㰐�������wo��LnT���I���OGowa@������ <��NE��{��*B��ؚ<���*IT���s�3O��w]@�H��BGW�P�����,ؓP���z)Z��\'ϗ&A�Z�Wj�.��������#\�[']琓�|/��)�,L�R�rO���UJϬ���嗽:q�-,�[Yk?�̠�k6w��`�H�PT���G�W� M*B� /{-I��A�����l�Ӽ;��Ht`K?J y�b�bgq6�1�v��|��6[Asڷ��z�%Q�l��hΓ��!$�6a(�ɭ�g>ԗ����K#ZGgy����P��,(I��H���{g��qO�K�$Y����/!6mm&Õ=��AsN#<��=�fk�B��B\!�#-h����pJ��� ,��b�T����n�X���i��/}0�vn����tz!Wn#�1[�����z�z�G�<���=P��d5��g�|BN�W��b�Z�2��K몳�Ip��f��3������+�C�Oiq7�����dw�'=1�Nm�Q&��m$��zcfW��]�|@!�p`�x�M��.S,������Z)o�<z�6�9О��ݶ��Q��LLsR(w^�&�$�Q�p�����./ ߋ�p�J�$��~A'�w����>]��7�Lp���4��N�HQҰ�eŔN�6�$�.��f0���СG��<�B\u`r2��.[φU=��b)<mP�u٣|�|韘k`���\(p��sa���;��zt��3��ݨ���*�������;ڗ���L�u˟�qYZ;o��±TH"η��#�2�����^����EP��%��a�y9�k��M�uC��f�u,q��� ������p5=�ٸ-����!n1�zR�Y��́������~d�-��M��P���=���v=`��;�O�<���������f�Dh��ݗ�z��J�z}�AQ�H��%��$p����o�u�����_�iZ~^�o�asz{�S"LV��r~�uu*mK%�Č^�*)��q:�C�p��u!S���F���x���B�Z����Y�"���J2XE%K!K���֡��Ye��#P_>HW��kX���g�j�U�#+��Uv֦���P���w"���M���B�=ļ�CJlw L�z*(��.SۚZU���}N~Θ��*��ysf瑕�"N�tq��'��č�z�zdl�� ���8r��� ���k�ͮ� �ܢ�-����#��`����s�fA8�.W��Uڝ}�?z��XÊhĄx��x�:��rJYue!z���j��su��G��"�Ojz��%|.Pm�x]�cB�Z1}ܕ�h�K��$� :��y��T�}�o`3�a�Ym�ar}-����X]�@�\r�k�H^���:A� i�R{?��V�w�7/� ���F������,���GJ W���K��~@&F����R��k������(K�>�{j�H"�;E�������ΰ����W+��n� Gc�����l���H��b�>�n��4|U����B1J�/,ݖ樚g��b%��p�0ybfF?��W�>�6�=ߑK�/��d�INF�}���?�y�F�1��jaM��s��� �N�����z��/9����*��Ctp��F��x���ؠRw��`�w�ɳ�Y#�Y�|� �{d}p�@�`�`�\��b�X �Ҭ�2:�;�jR�9���L�F�3=�@�鑎<�k����u�`ؗ�w��D�"���q3��.�7��Ͷ}��G��e?X�l������l�X�8�6k��. �C�P�����/R���rX͗�8�&}�x�S�"��f������:�$��l�����d��������W��~]+H:"�����%���d���ͬ�<l��c�!mv�c�+>$t�N��{׳lǞ��ȑ�8Y'F�'��i�a������������.S��� ���g��U_(��9@#4��eǁ;���?��݀��+�?X-����[����4��G$��=���Zt��]��g�~��Ӂ<�İv���_b�v������biH�w� ߢ�q��'��_�2��K��1P��H�l���%��A���̋m�?����U��c�>�[��JU�ߐf�D���Fw��P�P\>��w>���Wt����M(��sN~�� j���������샸��_�n� ~[�ZH.�G��ǘ���T��L�����=��x�@��������Lj�f��=��m͑���ى~���;J�����r�k߸��d�A�,Buwo��r����dm��Lz�x����%^N��։~a�Q�I�����iL�k(�{��� w5��A�h�(I����~��zK��-0ܧ�l� ��6�~{{ȅq#�L�E�v��fiV�`)_}¡�����P����P&��v��(������e_],�A|�5�EK�/p8�-�Z�L�yw������n�a��-(�ҍ�ːCڲ��fPƌ,f\��������9��;�r��*�TU���1������Q��c���f}U��(W�W�铌�Qu��:�~A�ޔ���Qw�Zv�`tӦPǹ��'dT#6>�Y�1�
Behavioral task
behavioral1
Sample
amRogVCq7lOcAvHG.exe
Resource
win10v2004-20230220-en
General
-
Target
amRogVCq7lOcAvHG.exe
-
Size
6.5MB
-
MD5
b3843723c9238af6d0c2a5d93305eadc
-
SHA1
3796a64fe59ada4167e5c9cb9b60897a36f3eed5
-
SHA256
22cdaf79255f89bbc2fabe044ec0daf3187b5144b42329b834c7c6125d5fe5b5
-
SHA512
ffbcf74a88ecc267c0b7315f33e5777f65a5a57ec0ac26afcc237ed528d14345bfd15b91f1d0b4df2214972de6a951dc0b613cdfb078a624a9567f4e32d7d8ef
-
SSDEEP
196608:LQT6ERor9o6ePVyRG1jwOJldJ9jBB625A:LjYISV91jw0lE25A
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
amRogVCq7lOcAvHG.exe.exe windows x64
649ab5f6b6efdce4d7e4a3b43d604bfd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
advapi32
GetTokenInformation
imm32
ImmSetCompositionWindow
xinput1_4
ord4
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
d3d9
Direct3DCreate9
wininet
InternetOpenA
psapi
GetModuleInformation
ws2_32
closesocket
ntdll
RtlVirtualUnwind
normaliz
IdnToUnicode
wldap32
ord35
crypt32
CertCreateCertificateChainEngine
httpapi
HttpSendHttpResponse
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 667KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ