����a�� ��♨,_�$�¹��y���*� �.ڶ���댢"�<�V����|�U�����w�����! �jf�yBk�\�c3/��3��%��� P"u��Ra8/����ބKj5czC���dE�龥����z�!Ɍ;�}��#�q��,�:QD���L��r�A�TT'��G��E�n���(�ebD���h�����_�|HE���7��[�zV������@R��@�wZV^Z��Ȋ앢O�^jivq0�p,��|k�R��$*:0i~�H."� <.��r�����Ȧ)_��lι����^e�}�7���/`��k�w�j X�Y�q<@�R�)��hP����������p��\m���y��AP�,}9�� Rb�#;G�d3�1�F(@��f�A�`x(=,BN1<���:�u�Ki|?|��"��}���d��}�S֧���Y>������{�N��c�*��X\nH�qU�롧��J�eQ��-��,��_��Ρ.�z^�(G�P�%-�����ϬYW( -��i!�j�ڰ�OLa3/��~�,F*|��,�����<���z��?�W�/Ξa j����[����W{���p+(�2Ȝ5����q���쯔J�6c6��!��R�$,�m�T�_4@j�R�@�'��MW,X'��:EO�b��0<��=��Kq�KUA�z��ymJ3t)��!4\I�G��0��Լ����a�|���%���ޚ@�D'�4�Q~KQV���f_�,�l������)��}�L��%h����5l���v.dr~���c���5�l�������_�� ����ݨ�B�������X��,�>*2�WM}.��O~��(7Z��~3����վ�����;�����Cu�I&�0�D���q���� ���7��8 ��*��Z� $�<K�s������A�����['�a�b�����n�I�v������6�=:�A����"#v8�Ğ g�Aa�* -bv���Âi�j��ڪ�Ge9+#70;�C�(j�R�y�Aq�(�)��}�mI�Cɂ��_�H�% eB����m,�V�Z��ª��st�eZ�0�]ؿ���͋�Ԡ�U7�7p��TGZ�=8�Q9-�z%uG��h������l�<����x�I@P�߮w;ĭǰg��0����`V*lV��$�PLw��H$� o|�!���� rڧ�Ь����0�1|Q���jY 5��D�h��#�jS݄���(���t鰘˽��@ꭗ�3�:<��+7�,�qش\ ���ƞN;�wFd��Sg��x{��v�0��S��eE��X�-���]��:���>( �(s�MBa�ɳE������K�o�kD_㼊3좤���%G�n���دo��(�W�# i�aGaQ;p#h�,�h���Q����7������7QS��mˎ瘥�e��#���fU�䯤���x8�k9ZE����/�r=���f�OvG5w47m���]���Ś�l�ACxJm��Dj�l؊���_Sg3�F�o?(�ة쾅�Ը�XvY����\hiO��|/S.?�AA���d}�~VX�p3�ku%�I�|ν��`��*�; 6��"F�q� �SqU��n!�����K#�V�X�C��\�"���c�K/�8ԣg�T�0y�k75 �J�Wk�-�$�A�����M�"����q���g�����s��I�/��`�`�P�-F�`E���U�% ����1H�1tEhF�ו 4��[���Ue`�����얏].����Ph�'F�9��lz����w@�N�P� ��+Q���=�Y�������4��v��'D�i^�b�V�L}�����M�7S�n]��>���}���$�>�)��s���\*1�fJn����a����o)�-?*��2�V����V(�O}�%p\2�$�R��vy]՛���TԶAEu�y�b!��;��Ldn�PA�-G�@G��!��M�D�z@J����8���j7���u(P�٬v���.,W�n�;`^��+��Iϧ|�6�,�[*. b}���R芬Ög�p\�&K"� |�o�7�cc�5�?6̲g�(��y�t!ҥ�U\�Wĵp9D=�s��ҭ��=��z��K,�fp��]��6h�U�0W�u ���ȩGU�%��)�Y�g;�o���g\��-L���3������ s�����r�]�����<�R�ٱ�,� SO.��87ϵ�� ����h'�������a��5]W��S�SL �t��u�#���1���%�y�)Z�#�%50�=L7ķǛ�)u%q�V�)�8�z��!c�����nx��1ڀ��k���z��͓��� �e����}�4�g����M����5��a�}����ou�]�@L���~�$�~��~���@���B=���*���� ��!Y�T;kK[����Q�ix":��B\�Rd���|��������,F�����1])�&v<ro3ǵ�}�b��c��*5�q狰V9�%�Չ��P\XJ����h�_��Y��`�At�t���,�@6��X��7��% �-|����*�Ә U�����7���=l[~����v�:�ЬY!p$��x���"��b�_��v��ao��,��Ѳ8�4��������DI ^I "�N���mE�D��.U?o��[c��P`s��`�\W��O��O��/�����c�Sr˅�\D/�$}:��K��M�B���x#�s �|��)�zZ�5���͌�*&��[�I(��V���*A�>�V�Lf:�� ��QY/�:)]�]���uPQ�+W��~���tt�������t���]�p�oh�B�2�����R�U)&�"�q}|^hvO��O�9hݳ��Ü�Y>�;�y��P�,��%b���3�-/����=XT�����)8qr.�3����q�ă�����U*�x������g�R�,�a�E|Hľ,�ɛڤ�oTy3�g�j����ٜ/$�=Q¤�jw�������R��~�Ɇ���s��YR���w0�9+q<f���lm���r�8'w��y�(qy����X����@K�2E=О��c��
Behavioral task
behavioral1
Sample
weave.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
weave.dll
Resource
win10v2004-20230220-en
General
-
Target
weave.dll updated
-
Size
7.8MB
-
MD5
6f3874c666a2b2de623a5d1604c45e53
-
SHA1
8ecc5386c6b36facf532779b78201cd8ab3ec643
-
SHA256
9ccf48915c9079c4ea8c4cfa812289c23a0b16ff5472aed19baec4d79435d37f
-
SHA512
87a2a8f0ad915c6aa90413aa554c190b811bd66484e71d1b00fa5bef109cacfb5e021247de0c1d7625e1401c496007b9e3400156c5d076eb3b7213735969cbc4
-
SSDEEP
196608:eLJcIdC8tgh3r+ffJg6bcQXdMmK9P/sd21iYMbGj:eLSIriTdQdMp9PkAiY+Gj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource weave.dll updated
Files
-
weave.dll updated.dll windows x86
3984335eed0913701ed0c23bdf94db31
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CoInitializeEx
oleaut32
SysAllocString
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
d3dx9_43
D3DXCreateTextureFromFileInMemory
vcruntime140
strchr
ntdll
NtQueryInformationThread
vcomp140
omp_get_num_threads
ws2_32
closesocket
winhttp
WinHttpSendRequest
winmm
PlaySoundA
imm32
ImmReleaseContext
xinput1_3
ord2
wintrust
WinVerifyTrust
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
abs
api-ms-win-crt-math-l1-1-0
atan
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_ftelli64
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 481KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 47.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ