��W�j���7 ,5] p�B��U̺�f�I,�4~�����>7]���.T~�L��$jP9��@��:MS�೬��֙~���?AL�yg�>bAr%M}rO�z2e8�g���Eqd=�tT�oNa;/�z�@ D�-POמ -�S-?մM���6)��E�\����M�萏�F��C����&bk2��������Vf����^Bq1)�e����qC١�7��������~_C����Γ��14�j=J�K���e&7 ��y���3P��d%���v��fڃԖ�\��9Wb��ڢ��AX# �� ���_8� �Y70�(��gG�E;���������`�bA��1mbQQX��d0;~O: ��wYÌ�GO��vO�E���/�n�[�1?q���y��䕃���> h��?�����^�����1-mr��\���]�5V3� �@���n����1b^��-u�i�(�"�1q�@@5�3)�k��!�ՌLp��ҫ,���d���'N1d@��I��1���wN���E�����WW��R~J��`�~��̔P��+U���������"�����@�4��n������]�a���Q�� 8eS�/*^��.��R%�'NyU��%H!h���SlHC�k���P��{��"�.�v�4t����Ղ! ��K����R�q�_O�?�z2E�譾1T�I�|����}��µ�y���]�Ģ:�-�� $�y7u�| H���C������Hry�[�vA~5����7P��E�ͯ �H(����a�r��[T��>�@�x9�����M�UL��v�H�绵�Z\6N�$B��б�`�<�� K<�@<�����YX)ʬj�]%�@�d<�t����:�c����¦�__Ug ^�?\Z�cC��P0��F�5���w�-~����ݵ7�A�Fs�F��IXن��\�N�����)�U�{�&�=�S��O�jK��=_����J4�w��A4��uB`�`�w�W�OAgl���iz0��esѐ�QREe9�\C:����h}3�^&T}�Z:JxQ�4�(<N�k���@:��P�O��5��$A�:���n�KU� |��M����\8�m`qPT��fU�1 �7RqW��� �4`�r'�Q�E�g4[�{ ���� �כ�����U�YY �߅�Q���W�q���,������:#��5L�: ؿ2�^.l��G�O���L�F���Z(\������z�˹r�������mغ��6�-g�� ӵ�k ���k�V���H+}��L:hx��}Uu���R�p�5�v, ���ʾЭ�������T>&��%�nA��1+oVoI�ĭ*0���ר^�(z �q�OD��B��u��3�-ܞ�l����1�)�Iz�u���jO� ���g,�*�j�����'1.���z�3��v~��&��YZA�Z��c�Y[ �ψBZC<�6@1�<#ճ�~c�Ӆ�R��"���Æ�<���;5<(��A6'��ݭ��c�+<���E�b�o1Q����=�؍�#*�eHD �Gns�ِt|�r��q)�%'j�S���0�0p�8�@O2Dj�����>פZQ�?�� ft�k+������}܈�$T��Uzㄚ��-G��v�������.�o��f���Ac���i�k��y@$Y?�T�=���P��sV�S��G7�m}��P��jN��!-2yꬬ���8��Yv�_djg����k�%=�7瑪���wd�1#IP+�y���P/=8���U}��5���%�|O�����YHv��j��o.���9{#e&{oȳ��}����.�,��^��R��0k^�.�%�'�Y�6�li@��]<��'����~[{ۤ�m���&�i�uu���x[/F��~@n�h�P2��d*F���*����8��\ݔ%�'ɼW-�X+m��X��:�3ǚⷐ����� ��p}ȋ�/���#m�ܻ���z v2҆-�U��U���z,��z%3y���5o}�X�z��A�xjD�e��yށ���k6C"�t�e0�� �keks`QL\�.�qM4� �~B���H��feh�c���A*Gb������D���to?v�P�}�ab��p���bw���N�ZC!���n�0l! �g;,��H���;��Y-[��s���K/Q��q���wN�"'�18�7Z���v�X����n!|y�:ڙ�%Dw1�������M<g����"�r���I0��L��f����Y��D�_��3����O�����a.��x��v�:j[��;Ѐ��?��U�Q~=�jh2�tG����ה�dj[��mB2��*8���b���-3V����.73 I���'����H��Cz��R���>�f�� iy�a�� :���&�/�IX4=�<ڡS �+�+���c�Z��k��� �7������oݛ��3��y�=�"��-s��5���F _ ?��d3�6D>�G��p�2�.h��vbҺ����,�g��.ɬ�'���J���i��SU��`�M6@��d�������T]O�5�i8�b�R���l�U�4�[1�nC��}����#CnS�-6��F���P'��)��lT}���(l ��7H�����Ӱy���!ͳd���|�<�β� ,�=��~|Uͽ�������=�Kp���(��fN��(N���cl�qe :�3�����-늉�eB�#�،�؈���[�(`�����p�Z������Ar�uJ��#--u�{o�b��*W�ށ�m����vEt�uQ4Ȥ�.Q_D:0=h��N-+����q��Z#� ���< c�|�����"d�a(�}0��L>L�o�'?�g�`���)�C�� S$�iUE��߬���]���o���N��VbTʏo�Ė ���U��A���f=y�E���y��f�W�Z�d���n���@8!��.�{�����P�Exl=��W�wЋtj:��� ����6�� �po��K��/!��`>�ݟ2���]�T��I�]r�D�C���ϡ�h�l�倧V��6�,s�������n�����Csԉ�0��
Static task
static1
Behavioral task
behavioral1
Sample
eVwg1c1tLTi.exe
Resource
win10v2004-20230221-en
General
-
Target
eVwg1c1tLTi.exe
-
Size
66.8MB
-
MD5
4d0a2f3c4c7933860e837fea2b0afca8
-
SHA1
2b1f4cde93b8c141ac596615c6bd8acb4bff16df
-
SHA256
317eb58e90b871b002023aa7c6587db54fce395ee4680f89f19425ea881bc1d9
-
SHA512
8a6eafa0806e448420d41a5d794bb7924694ae31c227b5aa87cb80bfe871032001fca262adfd0654cb3d6c5cc803fda709dfe4fd9686985ec2448af32fc4f489
-
SSDEEP
1572864:H4AVXeR1ZXOZ7YAtsAZL54vqjD4kajY+0BEJGYTyfwO:YjZXOZ7YQsAZL54vqjskajlILjw
Malware Config
Signatures
Files
-
eVwg1c1tLTi.exe.exe windows x64
ca9d6509ad8136b1d900457a59d20263
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExA
CharUpperBuffW
advapi32
CryptEncrypt
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
normaliz
IdnToAscii
wldap32
ord50
crypt32
CertCloseStore
ws2_32
WSACleanup
shlwapi
StrStrW
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageA
ntdll
VerSetConditionMask
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 880KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 63.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 66.8MB - Virtual size: 66.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ