Si���n,Sʲ"[d�F3�r��Iڦ�ˮ��x�G����a2ph+b���ߧ�,m�Y*���N��M�K�ղ )�)��w��H�W*x���Ҁ#-����AZ�(�ihO��^��R|���U��β)�J��L~���ufJ��.4�c$'a?����QRaږ��$dT�`c�]�xgi4i)�B� 5}����D�wB`C��̂rz��UȮ�_�)+��߉�]��{⽢���JƋ���F�����4y�O��b�)�mnԶ���ּ���lb�d3�z����Os�_S��{��a]�� ��@�8� E�h��0�5,�����.�[�2b��W]��A�92��s�n.*/�����Q�W!������֝�K'U�m�|�ev��㎧�/(R��ȋ�������v����ʛ��I�qK�<(�8O�|ئ7���%4��X�X���C\� N���i{�#����X�k6�uq���>�֞��\nSh˹�u���ѫ�o(��%�U��yM��f��wl�'���.�i���mU�����yb�oy�rs�hz�ֶ�.�kp-��ڸ6O�^J� �M"�q_m�zMηUTe�դ� ��Ȝ�mta�f��}`5mNK � �ۤ�/�X�$�#ިco>E��B68�A�e��!�{��lLGt 2���H�bO����zۉ)1~�R��n ��2��}���f�Z9����PS�$�j�e����R��ͩ�V�M3O}c��k]� ��Ia��"�ϝVwh�|���:k�rhu����'���,=�8�L�P��{� #{f��B���"3�^p�+*:b(�p�; a�����]DC����Mt<.¬ucuMs������;�n��7n,{��y����V�'4�����\��u�L�>UR�]�&�W ��ґ��|SK��� .~ڋ���r��uQQ5<1��I(�a� *?�T��E��a.�Ýa�$��8\I}dV9��s#݇J?��ٗ���{l���uH����WD:d�����IP��J�LH��/>&j��ka˯�;I�W�#��R�6X_����+�$%�����o_s5@)�$;�t�`<a ߲�k����p�n���Oe��6e�7`��p+D� h9ũP:!�5EU��r�Z�GD��Db�)�]4�-�����O��#�����Q&�0�j�Nx�P�pu�n�?���G��B��u3�1v`'8���ʌ�Q��>��J���:{�%n��,X<��VU�5�ʘH�����uY���U˴���P�+ [���'�>�����%�z�s�Gxt��� ���W��"��Uʷ����3�|�5)������W�ߟu ���g�>�()q�=�H6�L#X)��7�,/��E=�J��AO�7E ��_@�-��1G�װ(���� <��dByh�V�\j����NT 2��4��<`�If������t�[�aqxK:�AX����nUB։Qz��������_mN!�ope����/Sl�DT��~���Y@^7^��U4c�-0�W��m� �]�Аg0vD_�H"���c�Z����eܼ� �|�q��5h�����n�����6�"����P�������������X��"`�����ie<��I��`}�8�3�$�UR�y�ab��7[$��0삨T�Fi��Q#����J�����R�)����_=z]M��(@&�4m���M� C!�5RqsD5KL�]�ڀ���D�tE�Ip�)ր�8���A�0�'��yOuj��ec�UW���9��������ھ)U����s��e"E�r���+5��Mp�ާDt�Ӄ�61��ݴ�\L`��!x��zI�5�4HŌ����;�8 1 ��5���#�"�6���͈�"[�@r_d����pY�a���K�@Hs����'Ӵn;n6��Xc� bjp(^[,��O�%p����<�=��F�f�] ��7�t]��~�ڬ��>Y� ���XJ�[�'~������2�1J,���ãX�1y��[� "{4������l�,�.���D���v���\�jg����W�)���Lc�(K��&��/�l�0C,�6?��Hy�07�`��S"�s>�$��%��=X���8��R�����A{����.�E�I����{�6�z@U�Z����/j[�P��7���'+�G��pN���;A�M�o�����FTm�� s�C���=%C�Յ���*?���v��F�A��滏�K����*'S2Q�A�����������;'��`�'�N nj��< ez��[����p�j�V������_�2�U&E�:)Q�E^x�R��㖓I�XO3��}� ��e�*0\�&3����1ێ�֯/.趝�t�f1Ո7�&U6V�/VC�|$���i5���פ}Vp�>�|���@7|��<��`s�Dۀ|^đ�+���O�!�����0�ܮ�ΫOW5� ��bj,�dJ�C��p��#6���TM��\���z�1�0��T�rh�:�?�U#`���ޡ��c�����ƖC�v�Q�q������N<�?��c�H)q�d��\5��q�nqqh�}e�UQj�q�E0M�<l\L7����i���4Dk��YP�N���Ͽ���=�L��q���ׯ�����`�9����}ܞ�����D{���6��m�l^DM�Q9֍���t.3����M�uO��&����̼��`Cf�P����!��<�z��r�AG� �(Q��M��HN�z��Zj�p���j�kka�o,�Z�����1���;�v.Rȡ��8��+��/����+S炱�sq]�����?�?/?�x��y�<�c�4�\0��+��,���O�Ω��C�cĪ�����E~ �ۚ-�eBR��P��t� 8���}PigG2N�v�**i����M$>X�9 �b% ��N�1{'���l"�ɋDX�, �E@fOeQ��c���ί��{�:���R��6���p.��վg ��L���+b~`�q�g����om��[�'c�!�%+�J��묊|}�bh՟���{���z�|�[ ��>9����~��e)��-
Behavioral task
behavioral1
Sample
Permanent_Loader.exe
Resource
win10-20230220-en
General
-
Target
Permanent_Loader.exe
-
Size
5.1MB
-
MD5
adafde1dc3ab8eecd5e611cf6427dbf5
-
SHA1
424245983e0996571c989f6d6f5236702fda800e
-
SHA256
6c716a49ea22e7d028ccde485d5c4ddc236369c9b60eedd3602d0172d42a5b9c
-
SHA512
ad418c58ab787934b42420a5c43e0066f2732d5c9594f21496013931aaddca77bb4f39547dd7eb02e1aad3330d573bae72abf3e57cb4341e81da53f0e661b58d
-
SSDEEP
98304:eq/WT/VbNl7PAk96LpTVfCjENZvSHj/F9gY2lF/N:5uNndALpVfCj68Hx9l2L1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Permanent_Loader.exe
Files
-
Permanent_Loader.exe.exe windows x64
ff3893814eb626e089ed345cc0288a29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptGenRandom
shell32
ShellExecuteA
msvcp140
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertGetCertificateChain
ws2_32
bind
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
freopen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncpy
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ