����qjȯ%�Ӳ�j�<���t2�k����v��������%?S����a8�u)����On��Im)��"h�����l�,4�ʙ�Ͷ��a�C]U�`�蜌lv��{��𞢭=�7�B�� %�.��_v��W������2|p����Hc�u=��R�Ϗ�.1��ɲG�?c�k����"7�*F����m��Wu�ݐ���Θ�=�8�f�H)>)5��㳦�8�sp��W/u�W.8n4��!G{ܼW��8���K���N�j�F�F��@���AP� ��˯�Y�lP��E:�����9_} ��Y�LҦ����>���h��w7�]�,*A�������8�NS��mo�u�����;���P���8����:v<��L��~`�&V��s�v!��zt���zy�@TazSj��H�hx��q��>� =����v\�Ax�~Sk~/:6���u�)$��R%�G4� s���>���Q���]�*JF���T�R����D�����Vp�3��-vCY1���Ɨ����)�)��I�^^Q�m;���n (O�Yy�g4 �bK�2�<y�m�A�/��6~B`ƣ���HR��m���ˈ&��5�ѿ�Bb���&]�̕lu"B0���AB>�����@��m)��NIW�9��a�����!We�b��8�=R��2Q�Hs�Y�r,�?�9��=%�������p/F����煘_mC�t#�����-��K>d�w�|5�#��'�]T�6�F�Ÿ�����>����mų�;�u0ieУ�(�*ܑ\�=�&�� ��e����i@k��-�*]�#����Ho�pN �����0��E���p��Ѕ�>1}��3$��S�:�#��[��:%5�q�E����NeAn��X��ʈ��N�T��� l�)���b�q\�!��̆^g}�`q��L�<�Q�Z���~�0���ϒ}�r���?�^�v"P���ժ��RꋋR�+���I�?�]�OY-VA0������PG�����=���dH�rM��3�B�E���lԈl�ȹK�����[~}��X���Rw~K2���5� �<@r���0��p7�v�#�~u���>%e��+�x��I� %�c]���U%�oKwߕLt�e:�{����]�3��d����c�6r`*ѻ�K ��a�Z6��!X0������Č�cY�����$9�;<#d�o89�z�kE;��"SAM��R��m�����kA��a����̴4zg�P�,{C����-dB�aG+n��+��"04cr�-�+���Pl ����Ս_�(�K��|�yK�D,r;%!,;>1qx ��w��g�'��O�f���#�_rfM�/�Ǭ�;��0I�e� 9�<��J�0��y��@՟���WZ�6���pHl�D��X���X݇B엠��S�B���`|s)|g(�Ђ��Q|��sX_{��Kc&{��@r���������±��{4b1����Z�s(8$�1���-�ےZ��h%$�]L�J=l��X{+�O g9 d�\ ���p�� f}Ž5�E���?��J*�݇��y�����G������j�?4��-��eӆH6O+i����{0Փ����$�����)�@ࠟ>�^�4)8��V凩 ������0�w\����T�p<T���V�7n�=O�g�t������d<�飅�ښ�.���ص������M�5/Dg-[�b����$ fQ]�(9���V����d���i�,=R�H��݈��9�b�Ғ�K������ov<;������[��5p�x�����l�J�����-�W'�����%��z�`��4�U���0~Rn!M��Ӣz18��}i��y�l�2 ���t� �_j��������Θ�me�n���x��U㒹�4�)��O�h��3�b�3$�$��*�N��� 9+ ('���� �@�)M��pNɇ�~:�+��X!�� Ώ��7H]/�p�[D˕f��B��(��=oRHC`�(��-�����:z��j9��s1�(���� �����[���té0J��4����g�{'��9P�T�������i��xS.���c���*{�����x5��ĉ�s,��ݒ�J!��zE���ǰ�ghл��`�a�Z��Svo��j�����t�M��t���j|�OP9�Q�WN��Z?�ģ����D��/l4y,Ȳ�lƼsb�L����Ϫ�I�u�:7�P��T�RQ����i�3�=�u����d�[�Qq~n*���7�Z�i��^�P�5=��J>�!P�5r��7�����=s� \b9/p����hv B݈S%�6��!����Wc�](]�ʴg_p?,PT�2��R�M�-�j��.� �G���y��F�����-���\Ȥ>PI[l\_g]��N��}��8�@�����[�Yxb�E��+V��F�f�=���;�Ū�s�mC������,�Z���������b���^H,l?:'`��Kb1�&u+�?e1x)�7���y���������3�~x����<�ysq�ʭu٪r^�݅%��(��9E�0�|��_�<�!;˲�R��8TJ�ifp-�x�uzS�A�`cM�w�OJt��w��9 $�G�w����C5c����)�3@��i�&1�!XG�����,]�G��a˩ŕ���ut-�,�����!٤Q!p2��I�$:��s��^xw���.c�/+����!����ה�w��������9�ઘ��d�#��n*)FIk�'��k$a��g��.����}9J�Ԉ�}��68�]]|��7P`���ke���U"��lci��_��7m=àrV�#��i�y�M[@霌(�խns:li���s�}�ڬ�v6�HL�\�=½��?M�h$ގ7���Q��+3,ƃ�䬚��7���0z� �<f��ӟ��2��$(R\^�����N����= �`� cn��AX����9�+6�1 ���-R��(���ű���\+���N �B֛6�,U�Z�PB �,Z�Ԗ杁g�K_g�0%����aW�NTi�w�_7�,Rd�z���u��K��|<�Ġ]�_oi��u\��(0���9
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20230221-en
General
-
Target
loader.exe
-
Size
12.8MB
-
MD5
210de482db32a4104e72a6f4cc9f23af
-
SHA1
ab5efe33873a0643e9b24ce7aaec525753166444
-
SHA256
52c70dd6dcb3b00ab0de70c3f5ded658cea1c99f46b5f8f7c7eab111166e4d36
-
SHA512
e66ecfdc27c8cb63efcfd8d9e8437186e8d7ed4d0ec73a22eab386355147b517f4ecfe4b0338bae8851a562e19e6003fb381d6cd4a036b0083fc803c032a0952
-
SSDEEP
196608:xJVUMq44heNP5AI5wxE1Ny8yUN2g8I0/ZzzFW+Jap56iKW9:xJVW44hUNeEvy87NrV0fW+Ip4
Malware Config
Signatures
Files
-
loader.exe.exe windows x64
f12e5bba9dfe81917ebb536d23c09719
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EnterCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetForegroundWindow
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptDestroyHash
shell32
ShellExecuteA
imm32
ImmReleaseContext
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
d3d9
Direct3DCreate9
ntdll
NtFlushInstructionCache
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertEnumCertificatesInStore
ws2_32
sendto
rpcrt4
RpcStringFreeA
httpapi
HttpCreateServerSession
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
_close
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
_getpid
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
Sections
.text Size: - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tren0 Size: - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tren1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tren2 Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ