ڢ=%Z�^��Șs��!�Z�y�bg�;i�����j�M���j ��G�g���.�-�>�p�U�u}#e��Q��l���'e[�A����|r���CتȜ�m*>�<� qb���Q�����r�� ����K��F$�A�����U&_N��!� ������L �cB y#E]��WlA��Бr%�P�d��}.ʼX��9Bk������$��n�� nF<�V4}~x�Xq<i���T��>ZT�D@���V�4vԶ��)R��Ȭ�h��\�NJ+T'��'���&!Qrx���� ڨ���.�c\��N���\��ĢK6������6����X� �WH�S`<p���ƈ��@�y(H���D��~a��z����20�롾î+$8i�b���¶��z\w߽۱ֆ��*�����,�V���� �U��*6Td%�9��Dc_O����0�p*"���nU0��zP=�P$j7����ӷ1L�W��i7g{��+Y+UgY'���1G��2�6`N�CS��ƫ"J�Q�R����s��V��(�|z���A9GT��;���z*t$�@�'��]��*�w�3^�7ߕ��Ԣ���2l����j� �{z'n֜rɄ�6����1b���P���;Ǖ�!�"R���ζ�lCЪ����Ne3=7_ln��J�)Y�Ԭ�{��P$+�̨"^����I78q}��6i�Ik2�!�L���z�rVf�Ɵ�Z ]�¢Z2V�U��i�U���������B�����W��}��Tj��f���6�"�9�/�#7��W�����*��}ڌΦ P����X�j#_q7<�Ԑ���fs�h�����֏_?7`�9T����_HQ���ztk6~Xj���Gj;�5<h�$���a9��L�o�p�O�`�p}�v�I�u k��һ��|���`������I���ȍN��|ŝ�@��Kj�j�I��+ ğ�\������;Ͽe����Q��cU�֧�P�!X�D<Խ��,��B�d.�(;r�/�y!�g�/[�c�~���'��"�IK�b��t�\.�����C�t�C~I�� PQX\����K3MMG9]p�I{g�:�NX|^�E��:����`�����%��� y ���\.+i&�5����6 K7mތ �p�8��;��F�p��p�*�� �6x��o܂OꩩN(h��A�}+�?��N�V;���hWy����X��f�?E_I���AК�g����#~g3C��h�;](��= eЖ� ݃e���\ '����e89�y�W�ۀ���+���*��_���AN�c���i/c�t��NX{ìY8m��. D�"WW���y>ů3US�b+5��6Mul_إ=<�P����n�i�$:�G�k���s��Y�L��2 ����S�:�w�"����y6ŵ�ࡥ+ o��;�4W��-x��\ iX�$����XXv��1��*�C-鹠�=�����k���k-�(v�Z�1w�HE ������I�H��ۀX�r��#,�k�L��l��7��S=��,��s�y���l[�B:iY���!K����C��j��]��Uw���q=�8lU�����Y�I��4�L��͇�-`��e�h��ʦLU�pY~�V.��ܼ����ԋA���́�>� iR���,��_�q�}S�w�{#���쵨� �*n�ɞ3#�P��ND�I��#��g��h�� 0�R�y��Y�Ͽ��(D���C��#`_Ț��˄�f�{�P���w����F8A5�}"!�9���cg�ņ�ck�J)P��l6��*���F���IU1���;�����aRө����"�{u�i�z�z���������\L�~�@�K����Ȱ��Z}"��8�Y��)`�.�~�aì�Y�L�)Z]��S9R�������0���-/|��ĩ�d��q��0�7��̪U��yA�rp�`�[�X����c�`������r_}GH�d5� �N�'UJ�@���x٠q���P����f>����l����gXo���&S�\x��k�z�<5�o^�LgҊ���֪q��ɡw��@�`�����SA�hѴ4��-E�� ���WSpX��P�(yg���v�ɱ�s��M����Kv|3[*1��B�"Z���t��v�u��/� ��Z�D��n���Dj���/��������^t?�v+�G����ϐ1��u�� )jMm%4�j/W:��.ɇ�,��T#��^�Ϡ,�K/q��8�ENء�������Xj�+ ��r���������sy�g�xp,ۋ���#A�C���p��knIy�P��P��~�Hh�0��j�M}"fȅ��� E `�3X�i��iW{C���LQPC��-V�Ё#��U6�b.:���By�/�A.:tp��A����o��Pg� �a[��.���o�{G#�z=aH�X�:]��,�N^��wH����*I�F�E��u;��BB� ����Q�7��?O9ܪ����cv(W1do�xAw2�.�y�j�?�i_�o&�W�.20��#o���f����S����EV��"�*Z�Iܲ�"ii-8(��*�`�~B�2&��J��q�%���}�����{��2��m���H^ٛ��ITD�� �`2h��Z���D����b�J��N�����J�~�>�ղ��qU}�+#:5 ��uw|_s���[(���j�O�[�]]���/�@s�^m�+��zg��ش�dlTBދ���{!G��R�ݦ��=��߯��s^��=RPs����*����C����#�gw�h��9�l�y���ZT��J��Z�%�i%oӵ� ����=�(�D#o�{x�:�;]ɖ���u�3��i ��S��6l�X����U\�Z �lL�/@>�C4|�L���G�m���pb�s/���}���$�N�k��m����!��m��/߹gs�K ���J�V'D�� f���Ԃ�w17�L)`+�P���Z�gg��Y->������'�ĜV�6܍v]S�*A +�U�l� �;�5�_c�����MHI��� ��슅E��S$/l誂�"�2!���C�ʬ�͵��
Static task
static1
Behavioral task
behavioral1
Sample
WT_ACE.exe
Resource
win10v2004-20230220-en
General
-
Target
WT_ACE.exe
-
Size
10.9MB
-
MD5
b3766dbd824a053ecdfaf233fc62e558
-
SHA1
5b77b0308bd124b6fe7a696e4a7785ebb5ee621c
-
SHA256
bd4e6480130709d9a39bd6cd0d65cb0fa0bceef0b9d44b6e446956e977bf97ec
-
SHA512
4d1679b4552bfad60a9209811f531bf7332281a4c0d66d7384a092d03b50248117d048704999b27390e979ab7a24c2995b5783dffab65e14bb911cad683e46b6
-
SSDEEP
196608:6wmheNcgNOntnlS+F3qDQrR7VdPF+n1k/THpCsaUpY86oNli:6QFNctnlS+F60JVd9+q/TH4saD8ji
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WT_ACE.exe
Files
-
WT_ACE.exe.exe windows x64
00991de259d7a2ad011a7904c68f4e75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
CryptGenRandom
msvcp140
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateLine
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertCreateCertificateChainEngine
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sinf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 713KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zzz0 Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzz1 Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ