�[E���)�z(����D�o̷��J�D�a�.=�ʔ�D8��h�Q��[ �8-Q]�{�e�)A+YRuۏ��<���WѻHxF��;6%��{X"�q�en�ͫ���s�hƟ,��jx�ݴ�Nc��<���J�W��UVk%v���u�L�#,��D��Q`:v�ԁ3&a��f�e�sc�f�sw��W��.;�N�"U8�a2>����G8��@�o�{���J�,9�B��[� 7>�{iՉs&�قy�܋��IĈ~�9�D+��p�dz��ב���~�x�X�W�Y'mK�����JnB?_t�ٍH�l?�I��h�ɴ�٢�%�D��1c��=ϖ)L֎,.�%�N��@){���J+;=��̀���,[^s�0<��J���ۻH,��*��"�B�G���H'X-��͓�D���ve��.i����)aÒ�r�j}l��+��O���a�o��j�v���F � �����%t����W�b옌�u����]u�p���`���h�;MT�8��Bt�� t�j�����7�Z:f����؏sy,{�q�_b�!���T1����3�K �R �.����;�a�%��8V1�B]XV���h��$ �e_�����ː佳�s��@�sJ~�=j v����J�gԨŨ���A1g�#'q�od ~���uF���u!�M�va��e����y&��\@�/��j�4$�PcF@E��<H̞���� E������}IdNtY�$9���Z��m�eWT�逭�A���晓�cŨɌ���������%��oȠ!2����yN���'����4椢�u�c+�n� `&A�(������ǝ�Q���`VZRq��\�FL!��6oɈw!��]���LL�g���fo�e�]�����59}/����i4��p��b�(B.$)s��"0�x���@�vKտ���m�`�͍���>R����������%l>ǃ�'� �uSMa"� r�ԫ ��7��c��oA�Ύ��lsZ�����Q��e���T��Z������G�O��=Wp��P+2}��lTG5v�+�wly��ձ�Cc��1������E�����8�{|$]^�IQ�����2��(�w����r��-��M��i�x[ �I��o`��t�Dy"M��L)�e��c|��iλ���ǒ�*d���8�+�B����t��n����ό�9M�23������4TG�L��#e|;h���k��Zg���'��r��Cf�V��mes��IV�|_(��J�B���L?g.��yʹ�?D5 �T#=�ӌ~mOd�a?��$��IK��U��%���e���(�9L �A��L��1��zn{��H�����pҾ�՜�y����"�ԑ�(L�q�0��ˎ?�� B��ef�H#R�{�������K�����qD��%W ��b8����l<̊[[���믹�0>JDi(����tiVx�2;�Y����ʤ���b�nu������Jv�,�ư`���h�}7�B�;]2i�4:�Z�0O��p��~�EIy����ѶR��kR�8c��%Ů���^ƽ;|��&�=���릵����N���~8��͌7MB��)Y<e3f���~�ģ'3g�Q��o+/�xe����w)� ���.��d��+/��'�O���ޡ�[��Ա@��v�E��.I3(6��s��\�˺M!T�% }�ss]�BM���T���ؓ��| =� � j[jtѓ!'X@����+uy���þa��g��N��T�j��g��V������ �� ��o�ʊ�y� J�K�o�J��k��+���;�ǁb�U�w*,������W��x����JJ�m\��waY��r?B�ٕ�-�.���R�1����FaE������qT����#�J:�`��������S��@���� ���Q�����ru̩7����m��iO�����5��}���b��~m*���E���HUl��ʒ�#K���N�����ܡ/����R1�����H����t��oT�UO'I����D�Ƥ_��f�3��j���!��S~%���� f�e�AZ�c�o<xR�L�R��lŒ��R�@qR%�_���MJ�Ո����Na�>���k ���B��5!���JطX`�DT��5#d�2�K�J FQ��5�7�},t��u �a���.�o�4��A,��hS��X��9$�ˈ�禨z\*��C=F��#����)���-#ys@�j{6 0�x!Q6��X�U�D��7���*U�L\�+N��t�C�ޒ�]p/%���K Ԫ�ȼ�8�L53��[$N M���g�'p���j��$L��M �~r�g_�nTf�*_��Y)�#K��^�r�A�a�S�i�k=_��Ш�U��HX���(��R"��-���V����0��Z<��}� �ϴ^�C&T��E�"oU���M]�����O���}���gd��͎C�e�: �Ƚ���e�\j��8��i�JJ�N�nF o@�4ת�h�8>Lv�\D�r�p5T,�u�4+ú��r;858��Է�NM(#��� FB��������,Ԏ�[K}��B��Ԩ��S��^3��ˏ/i�ȓ&s�]m�z/��x��:C���'bS�ļ�Q��<��~k(�� K���._����yKX��v�s����$iu��irO �>h�����2���E�e;�elie鹘�/�k��ѵo��j��N�T�DU����0J�\ek�F��j���1�z ��魎��Ju��#5��zLg���w7��7�k�[KG��̙�0w���,�P�����m��\�L���xk 9�%�h�:hW�&tlm:�\�E�c�?���$�"4, 4[`�u�������iM ���>7kM�?sZN�H�fJ�"A�&]<��p��~*�I{�R Q���KK�E��}h�A�������g�q��?�A?y%����1��/B����n�S���E3��ʥ�v������=�6��0Mi~S��[�t��s�18,��myĖ> ���=�5,��}8�wo�"�A$�4%1�25v���P����<s�a��R.vJTjQ�@4���_!�;��G�n����ಊ�j�Rn�>����
Behavioral task
behavioral1
Sample
BW-Spoofer.exe
Resource
win10v2004-20230220-en
General
-
Target
BW-Spoofer.exe
-
Size
5.6MB
-
MD5
67451b7db8bdcd28e6bd16a928794c6c
-
SHA1
c4e5685ecbe6793267f49ab72a0189fb5f35744a
-
SHA256
3706ed1a2a7e708ee1f495eafe95c03ef9d589850546ffe792a750d7498a45b6
-
SHA512
16d8134b87a6b26055f0628da186d842e46a19df83387b3b7272187cefdb1efe86286dd027da181a42dbd9edfbb5a77fcdce561af61be071c337810b117c392a
-
SSDEEP
98304:qeVN/VSp6wcY7hXQBkAZu+nBx21QNAz2rY6WQU9hUD69748C:q6m6GukCb21F2Vp6dtC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BW-Spoofer.exe
Files
-
BW-Spoofer.exe.exe windows x64
ac9e5e2e68145d45098acc0f157b419d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetLayeredWindowAttributes
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
msvcp140
_Query_perf_frequency
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertEnumCertificatesInStore
ws2_32
ntohl
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ