@�7B����b: ��H����T�~ҩ�6���]ĦSLF<;�A�i�ƠWA���c�>�� � ���<��0p��H���oUv�_��;X�G�ໄ����C�TI�+��Mp���Aw��"�lM��(������|�8��3<y�"�.ЁV`}��v��T��~�~�f(�Η�7>�" ��u(u0 ��r}B��F���u��ć�#�(�/�& ALI�}W}8SW{<◟����!ba쀆>H��]����_X[t���%��>����A7�������\��m\dp���:#�G'H���&�ҥ̩Ý���ؗ���D���|D4���vq���U�Kz�i��V�^j�gR8��<<+w]��9y�R��������\n~l��?g3b�XBQ(���Ӗ������H������jB8�iB��O������Oi�͉�O�֢XGZ"P}&\:.,`�m�����JlD���g��l��&�����f����6Zi���\�%F�'V)( :آr��p�������U��o5�fը����'�o��v�������� ��:��7d����-�a-���h7ě��H �/h���;:cVY 3��* S����x�ho��[y����>L( .��q��ٷJ:.�e�sB����0�[v�)9�Lf��[a�B%���zP�5����^��đ'8��j!��&nA�����!��쇋};���K<}f��o�H�\�*��� ��.�T8::<+�P�� %���#~@���0̼�i�W<X%�z���D�ԙ�m�9P�1g��v����י�Qq��,?�_�����v�����&���}�����zh=�5r^?�@ث�{x�@S�1iK��P�V=6�;3��`����@��~�ñG+�(Y�kmG�Hm���ℚ���#�ɷD���%��y��[���>C��c��%�����m���V����]fa��9%�.�\�T�w�%)s� )]0�/y��t�p����d������Ȉ�e��2�S�0,ҥӧT�l)�^�i�T �L��avF��L�K)?���:��o�]6��0wpǷ���D0����:��DB��t?�O�,���1�����W ?O.5���6���0�c� �O�E��zK��m�'�nR��f�T�ӓ�O��>���U�/v@���]p�ny"���#���F`�������Qr����;���ïV��h��G�y��9�[�^�e���j�&d��"ó�!|������\��3Hs2��<M��o ��̻�����/�~QR���5ߓ��er�5��1��iQW �c�yK^r��ϴ�QV��)���ې�����vT� ��nз*������m��GH�a��ϣy"y�#��zy���(d��B�=��4P{sq���3EL��ow��HpvĿ��?��a���b@�=����.���P��M���:���LgL���P���D�s3+h��ۿ�������[|'1�M�HaRɹ{���H����ek�O����i+�tO+'�{=M�G/��uSDsAZL8*K���~�ٯI�I�.�M���Y���ođnLo�2���mY��1��������c�κB�{ ɔi��n[C�����6�ͫ2CR(H�»�Q⎗���y�TQ�{�n����vj��"���!G=�h1Ԗ����Lv Y�t�$3lCܕg���1zF+��J#x�[a�������$�"�s{�6� ?%ޞEj�K�<X���:Va���Ni���M\k�t�p=,���HP^�Ga0@�9�b&���hN�S�1�E �0����9������4�{���_��D��쨕�ρ�?(5�� ���"U!?�퍽��,��Þ8���Ε ��B�)�拴��x�'X0��Qm�Zaa�gTe��-�UǬhP�[L����Q�U :�V�Zp [|����|m�5�g��F�� �KL枙S�x۵�I�RHVh��dH�'�� 5���~$.'�K�)[a���<Z���t�Z��X�9���@z�;a�9VV��{��"@�@�w!� �́��<Fg6�@jl���ū�?�>�,�A��C��(��G�\�<TB6b`�o/���� ڌ*���v��D��V�h�MaF����1͵��$�]N=�#�v۴�JB$�������1�g�j�5�/#����>��\.M���;�2�t��N�tM��K^���P�K(��8Կj�>+�&H���Q/#��H��AX\t���54@�V|\�%�o���Ӥo��}��dP�DAazRx�K�����W�L=�*����c�����_��q��Pj�Ԉ=sSc=�VJ�+3b�������-�h�h"˵�LN��@�w�}4mv�~���D`OQ>�:8�{�������v:��u��/-2LO/�2 F�J����\�B�M5!�x�c)�IX�9���{S���e�ƃ�T�p2� �#ig�R�����r��1��R�U��Aa�N��k�o�5tJ�&�R�d����J�!���}5��j ��)4�H�Oՙ����_;�Z���Iɵ�'�X����wJH�ls,:��i�%�w,ق���կc�8���O����^I�_��Hqާ{�YP�|'@�$�T?�_1>b:��M0��ۺ�ke=Hm�bZ�Qm-�:.� ����4��#ד��,�v�'��9D�am��N��PfP�/f>���k,�c6����m�ע�$XM>1WG P�_�wP�Z�D�5�H���Sz|���,F��w]˝Y����lj5؊��{�Żd�ԥ��g�8@]�Z�J�q��������v$~j��n��Pd����a�i�Ʀ鵦ԍ���2��qv a�� O�(6���W]�y?��v����\�10�����E� �>��4�������>��l�����.|x "���$5�N�ړ�dKnڽg�<�"�����\��5��6A������5��v/�Gi���>���Vu^���*T�����],[y�SU����r�W��'ښP���ĥ��ViD�,�:���K͐�cn���Y�|���m[+�4�89y�ku�903�
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
Loader.exe
Resource
win10v2004-20230220-en
General
-
Target
Loader.exe
-
Size
12.4MB
-
MD5
dd6ec1519fbe9d8ca2356fd0c466a1da
-
SHA1
de92a8bb291d36191d0715f2e640a8cf676d456c
-
SHA256
ee817a47266ae022b156f9c45b579c03100c0e933a8ebf2f7a51b0a8059e9055
-
SHA512
05c3df7cad416cf1d1c95e7956dca3ce05b9bb52fda3aef8a8eb3caed2a12917f30f03daad5fbaf195e1e7dc90f52df913de06321e22f034483373f15a8dbae0
-
SSDEEP
196608:a881dPjC+IwjlneCT5FHg6/+LGCOei4y1F6LX494t2Cs0DAAwvtAN7dZ51:crO+IGlnv86EGCOei4k2Jt2CPcdvq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows x64
355857e2baf2bc1d53d55f9a96a5d5ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opengl32
glGenTextures
kernel32
TlsSetValue
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ToUnicode
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgn
advapi32
CryptDestroyHash
shell32
DragAcceptFiles
ole32
CoCreateInstance
msvcp140
??1_Lockit@std@@QEAA@XZ
ntdll
RtlCaptureContext
imm32
ImmGetContext
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertFreeCertificateChain
ws2_32
socket
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ