��=D�d��q6!�'�-���U~�`J�]���)YT���j8B�#)������ϒ��k2I�<zh����:���_�oboO$�9L,{߶2j �*�T�߉ R3�N�h���V�4���Ѯ����i~��s3,�W��ς��7@N��(^pM��V$ ������J2��G�R��[B. � ��K� �L��I�MJ:�y$\�4�q�sL+�mI�!�ڛ������T��+���6aϲ�2 �O*��Fu�����������5�|uo�~�ٟY�I^�ª��p�Ջ��Ug~%H?�E�P�S�l��������M� ,G�^D��ц�ι�����m;%�;����by$w����.H@���j�L�q{o��oYb�z��@Z��xD<�x*��YZ��DN�X����c�ͯP q0-�����F�ѵv�Z|�OF5�+���v�j�&��1��5fr���lc�, "�;,� !��;�q`�r�t�HH���������c�r���1��A��cE��i�G�%�&�M_Y����\�U�qJ�W��&=z6e���|��U�mz��\2$gƑK���+�!n����j��G�� U��Ƭ&��,Z��ޮ�j�=D�tB;g�D��d�T��f٪���%Z TD�P4W���.�^��g1����)[i��J�jх3����V+������f�ɍ��-���'Fګ��P:y��M\�����/��W�^?D#N.��ч|p�ɚ?4�����pM:���Lcj2@4C� ��6�����RY��e���wx������"�m�J���oskG�0� ���0׃=*m��=g{�^���Ȋ��"�e������K�r��8���O3q6���[$9��S�3\Jӧy�L�b�ߖ*~�5ꊁ��2 �7RC�$t�������.�p��o������>>�pl�����|n%N�\)��<��� є&�]�=��6�u�Y�=C�)�kP�{�y4�Q|5�&L�6������b6 &E��X�۠ Ce<� c�d4lN%��~���+x�"cB�:t��L1�_�{� �s�Ța �k"!�mq��p{*c��6:ؿ�N�%(5��g�,\��{�b��J���א�������g �D<`�)�C� ��`^0�ǜk&�THv�خ��|�a��Fo��ŢT}�KB����{S�]�� �J���t̤j*�\��]�H�Õi.�T>J�)}����Qۗ�7�@��{]��>]a�6�h�h�>T�l������JF�ᖒ,߁��6s#^��-b^��c(���kE�,I%�G�G|rn"�Ӌ�,%#��TB=�~��V��HlT����Sg��A� =G,H�N}j5� )��:E>��I_&q@WwG^��[�5�e[����|�i�X?����T|e��*�F��~�ҧ� vC�4ɭ&) ��B*Y;FZ=clj��;#����:�d��ߥP�����43�"0Ĩ�*��t�ͥ��F����U�(�Vy�� ���I�4��%�8��7K����Dۑ�P�M8t%De�X {��',�����j�1k8�KV:���g��~�\YQ+��1v�m�f��0�4����'�5�*������n���3l�W�ٳ�K݄��?٧��=\=u0��k�^Ca�\���p��qv��O��0� ��Q4L=]��f6��]Nn�]� i�ru��'b<�g��<t'W�;�ε�{ HS�ʘ�99I����*�m�x�j�S�9�s�wo�|�ɝD&�F���.����M���~]Ѻr��{�νP��܂���^��h����B�a"�[�L���m�Q-8�c���Ȉ�LNH�2�3��Ď�t���Yf ���+f��Wk�$�JEAO�?�/��4T��v�� �A� �q��>��UF������8��Ҹ4l�K�i3�1g�߇�Lt�> ��U�����N�.�������`���}��v{AzO��>��t���ՌI�%�4bEE���c��/���_�N�"b&A�Z���j!&+~@��?l��31RZ��b.8�br@.cV�_4�Tn�#�h�۶ͮ�E^��>�"v,���\ĩ�T�cs�u�Y�`�lz��V>�������q�l��J�\� �bi��B:\`B�֤w���9%��������Kq��/�C�ֳ��"n@��ڸe���j��S>��n��<[��?n&���@u���+���ny{{a܇�Ɇ�U��:/Ymm��$G=<�/)�o ~��_����+�b&)�|My�/�{ӈ&sFC����1s���9�T�3Uػ���ɗq��Pձ03M��;7ҝ��<�P�Lz�MlTy�n]�φJ\��o�yʈ=j�3!(��oZ�"CA���}m�v꒗-�|����Ff��ĩ�n��/ %�i�&�`���=2Pe� ����ѻP�3�� IUBh_��1���]ڃ�'�4�QI���JFſ��ص%;��跌5KK������fz��y䪆�* ��,���͎ۤWt"N�_m�`�(�Cb���42D��q ���TF�T��B��6����V5y�� #�R3'���։8%?&�5�uun�YP�s�,)��|N�W��q;��VSF�&�������Mh1�e�hݞ7]W�9�k�Q�BL\Ó�A�C-�8��B�,��EC�.�� .p�;3�����~��:3W����&���+����#,����[g2���z��Ω�C�.���M*d��3H���@�L^=l"�����B�&�L$�f(%�akB������f��mQY��B�inЏ��2���N���X����|�XR��V�?�Ek�ȼ��kG��(�:����̳@Je�S 'qM�0K$�><cm��=gP����h�����o+��˶�Q�;�ƚS�����~�Y��_0���;�Lݦe[B��9��ڃ}�?Z0�q�8G>��6)�b��/��$:����Q8��l!�EɅ%�g'���D}ۦ����Li�M[�m�����q�����b�����JXW1�[)��W�c�o'W�]���Z���R^}'�|2���Y$�{h��^/������< �M��$�1�=��
Behavioral task
behavioral1
Sample
legacy_reborn.exe
Resource
win10v2004-20230220-en
General
-
Target
legacy_reborn.exe
-
Size
6.1MB
-
MD5
8d091028c4ffd16dc27ece61123736cc
-
SHA1
565e3355d5bef1dc8d39e22238f0ff1e8018e10f
-
SHA256
1e5c780d23d15cff586da1caef0da46a8b3f708d28e3ac309f26f331c63873ae
-
SHA512
aa828ce306d0b36cf566ce732f531befb3e9945e3e4acc3cb1be7f0958408688ba7ea540514ad365b7dc92536edd165b21e1c3fcd0e5fe39212b48467f58b40b
-
SSDEEP
196608:Z39lgBH+gza/hd2muMMVnUCwO+40sj/9:Z39OesqhdBuMMnj0c/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource legacy_reborn.exe
Files
-
legacy_reborn.exe.exe windows x86
1c3089afeecd11feebb05bc59eea335a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ