a}������r��74�@Zb1�r�>� ��.F�<��V����L���w:-�����[d��O��F�ީ� �á������M��B�t ��s}��m���l,;�}d3}z,�ȡh��R�Ookk)"�ơ�f���!~��[���l�J�"��9H4}�쫳Vc�i�E >�Y@�bۇx��zC���I�Jb-F+�;�,7�$[����%�j���NA����KW�[�_O=U-"q[<�(����~���}RGڨI���0v���f�ku��R�����g��@(Yߺ���B�B�Mt����+�a\�I@��V���8��8 �vz�s��'a�Q%�{���(%���z=�q!�wB�#����+�_/�a�n�i�7�Yv���__ �Q�[���:~��1�o/�$r�*/��}�UdL��R�e�.�V�%�mѮ��~ ײ�rVK��~��¿��������h�DǯiI�]R'/���^�\ �z��R�����!�#<+^sb�?�6-�.���I�aQ KY4���>�����k�b<?]Xɦ2��� �(EVh/Ej�^1� L�<eS��яA/��7㗖�L Aη��->��8��ôGB�˥6U�"P1�% ��CHK�����q�b� e@�����H�M�N��$k��!���'��z��f�/�s�C����;o�����Hӊ��@(��0���`v�1�Y��aI���$Ɩ!��\[w���C�b�"��n�K�pw�z�υ�F� i��pޤ�wh�Y�0�#X��i�\p�v+d3 �n�=dz���h�� �c�V=�aF.I��t�S$k�j`"��N��X�$χ�����Y���n�=�x��A�]P���<�����F��i�j0_�~"�Eg-cϦ���ӹ|��x^����)�Ad\ϥ��1�q�5�/gV��nd X�"�!X �]��9c�o�/�?kr8��u�8\������D5{l�&,g��%�9���4#��'R�!+�"6F7!�OL��=,���RȆ���������[;�0��+���e�3�Z��w�Y�$�zx��Y������C;�~n� 57w�-�N\���i��r��W�G�G$i�"1y �65=c�ס�U-^��ᐺf�Y������UL��dg�7 rXEi�?`'�P�x�o�� ,"Ң��C�6J*��ޣ��7�$�jd}��B�k�B2Og��7/K�� ��Y�,�!��lD=��0��Ow'z�`h�Ѷ�o�M�������t���O�F���L-o=���U`3�4Y(^�����/���Vȁu�\O�$�l����BM?�ٙ��^ 37b�ta�7�x̥��I����>��te��?��,Ra:�D!{,� �5vAd��9�b Q��G~a��O���Q����h�y�,��e�eJ�C��3��sz�cKcf���BN~SE� yL�)�R9�%�<����A�� eb�"5�oZ��Z5� �O�yXIB�qc(Q�����[����M5ec#ΊW�����=E"�/4\��gj%�߀zb0�'��ba���>ne@#�!7ٓd�C�9@� j�u��!3(4�qt�|��\Of�7h�PY[8G�^����'�\�E�c,���%�U;bT5RSʡ�BӍ����7Qv�Q��Lݽjum�#�����A`_�S~�������Z ����t��{.�D��{�� �\%YS����⺘ �箠�B��_��yT�ho��$d���e)�숧�R�����R�s[�3y�8�P}F 0$�D;��Ф�u����E��s�FVͽ������B�j��z�ǚ��QbZ�N<f=T��Oj<Y_7"�7���*f8�� 3(<���h����0�x ���PؙTͺ��zt>�߮�2�+#j���!�X���*������� (���[w��f2I�����B� x�C�����A"RdAN���W�B��,�{*V��m� �sލ�( ��wN1�Z�q( 3aK�U�͟G��` �w�M��p��DWgI&N�a�V��ݫ7R�� 5ui�+�ľ�V��n�95)0�N0�֭�Ϻ#jk�L^�Էt��]Hd� g�^ C>v��?���[�9jUi(��Hۙw�R�E^7V,��X"%l \�]�AU̠N ��^�3`��'eck�L_'Dm�[�\��[ b���\���ң3Lsn�mϽ��M�z�A}���A.�\0��n���� �̲�b�G���W��ͪ32�&�#)��ʾ�B)^c�SsBP».���my#��v�~��ׇ������C 8�0�j�-r�E1���\$���b8�2!��]�K;�F�~%���Bl��P����?s�E*�jraN2�W��J�-dBW�D��e|�"�N��OZ(�9��ZL��`�U����_t�W!d� �?!T������،`E�!�Ż��Cc�>f���"����al��sM��H����k`�H���"ۆ�aGӴp�sw=�^�W�E_X˺"V�7��=?2�U� ���0�����e�"���/D�����x �(�"V����lS4ޗ&i���8�+f���Мh�3�·][Z��F�$��\��{�< �Z%�����ɫc�J��0����k`L (�xaw ���8�C| �p.@���[7�����7B��p�������r�P��rZ\�T�1�jxAL �Cv����|c���)��:����$����l䅸�1@G�Z�c��~��zݟ�(��S��*5*�<��P0�h�B�b��8�Cfʻ1�bF]��Ό�2�yBO� ����at��̶m�"����ȶ�4T!#ZVC�j�Ze��V����##�������0Rev�P^+��J���c��C%���k^mI,6�X�.+=��i�A�}JW�/��v�j����3"�Er���`�>K,��cf�(w����T,�����5�Ȩ��wZV��rr}]�-���_�Lz���;Qi�yI�>��L&�^�)E�y�M�,i��k�O}n�����F���hKE�p��m��h��g|b��v��7Y���n�f=�L� #T���ƴ(U��Q��+�0�2pa��d2_�B:Rl�����>�
Static task
static1
Behavioral task
behavioral1
Sample
dqsBcEDIa.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dqsBcEDIa.exe
Resource
win10v2004-20230220-en
General
-
Target
dqsBcEDIa.exe
-
Size
8.5MB
-
MD5
84a9eef34cdc8c49e9828518195b323f
-
SHA1
b1ebd281a23cfa14a23075a586e2933a9379fd7f
-
SHA256
f6017c74d0ccd65e29b32bed68d20f2f67c4b3f8871d260764efae7f0fd385bd
-
SHA512
3885e179b78f110e6ac8f52c159c3df0bce61fbd7f633e13e39591bc2160d2bf8df7c966ee7193b2435728b1482dd6927f7cae7fe86b31e2b9e264e94d7b9e49
-
SSDEEP
196608:kG69vTixSICbLS3BrINA1tzoT7ubkrfI41/yCSZv+8GeF8ep:kGkTioIC/2BH1tzSYwI4VOvhGeF8ep
Malware Config
Signatures
Files
-
dqsBcEDIa.exe.exe windows x86
003beb5e3a35b882dea09e10c1ffd40c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
setsockopt
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateSprite
kernel32
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
gdi32
RemoveFontMemResourceEx
advapi32
CryptReleaseContext
wininet
InternetOpenA
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
crypt32
CertEnumCertificatesInStore
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 589KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.D|z Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SIh Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.;G) Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ