���Լy�D5�}��x+�ۦX��dfox�Y9$5��ULż���G��8Ϊx��Ja-@@�� uȟ*^��O�� G��<л����a &�&RFJ�n:��q�+�$��wP�z*��i<ۙ�{��� �����$_-�^_�"1H��*��T*���o�ܛ�0M����0��t���c�`��2�X@�Ҿ��T2�����*#�-�3�5�,�V�͢}v�c������� î"z>�iY���k���nzW�6�i:\xe�K,o$T5�'_T�h3�R��I�@�h�*��K}H���yc��P�Φ� wB�3�q<���-W%-�)$�P�]�軰��|2�����$Bhr�Qӳ�t�ާ��B��,�C���!���d~H��es�{9�(���¦$ n��M܄"3&�h�k�/��6 &1��������������h�xF6��uv͗'���nk_�U��W�sg^J�<kG�p,��b�QA�_pm ��C?5�.M�J��?�d[z�gg��$�`!���}%)*�q�c%eD����8ń3�)>����$cA�:8[C:��c�L�{�g����LV$H�������q����o��(�2|��?����V<���6���'����bI��ĵ̗�u�B?͋���aIp?� yS#冂h��� �T�������a�Tx�'K��0} N1���:٭֊���M7�%~�֦���]���:�~Ѡ[��I�VM֎����ǝV���ӣ.�-���m�鬛P_�6��� ��T�Q}G��C:�r|��:y�Mе�!�T4�P������*��B�:�> `�E�"r��K"s�N���.1O��o��:���M՜Ö ,=m=�Tp�6ɟ���],燿6�+Te=(�kF�/=�{��s�<�:ƻL �m��d_=��{T\��BH���.Ϥ�)���a�����qO��_��{V�R���LH��Ӭ J|#�ۏl��� yhi�`���;�z����������l�p��@N%g,��|ia�pU"���ȡ�lZDv;e + =��9�e�Ѱ� 6RS����b�����&�)��A蔷������Y��4����ϷpFQm��S��o��3 kU����X�Q��)�-͖`��m��#T��_+:%[�������w��7�S��Б���M�b�.��8ml�]�Z��L����<��l�`��ueO��� ~�C2��C�1��+��Ղ:�&2K>2�yDQu4���-1��=���M箷)����14m;r~�8P@y�| $M�ͱ� ����w��`xQF�P���چط=Q\�����f�V�C�z�,����ۼȲ"(\?[JRp0��<��%�r���\X��@���4��&�Y�!'A;��R���J��Q*� ��bPKJ�YZR�ODU�t'g�=��EB0�;��w$�NצJI�����R;ME|l�܍b�ft9¡I��c2q��,'�m�^����o�n�1���k��uc|� �wЊӎ����͐�Y�!~�=i4w�a^\�w$��M(�R��n� �kTI�c.���-�U� |��DY��=t�&�D}Z��������cp������ ���+�#�E�M�-�o��(m/�����ft�OK��A�F�`���;�ಂ<I�4!Zd�Q�cR�k�=:�$×58U�q��_�۳��.vR�6|`����^S��~)���ژ^_�� $���z�xbR�_��f�;k�Bs�Y��*Q�#��g}J�h�@?�WDY�v��PJ嘁��^��z���/G������u�@}h����^����2�X��9��2f�6�|�� ,�V]��+�@�+j��S�h��T#/�0OT�v_F�?����g�ݿg9�:�ފ0�%嚗ϗ������L�A��}c8d����ʂh�.�6�� ��=�\��m�>�\�D���:]����3�J���zi^C$�,A�K��!���Zl3��мBU�9�=�גo2#UӁ�������X<9��]��%[4x(��3��?�8� v~�%ߩk��B& �ڌk&�N/�6rX�-DP�zi�G�����zS���Z~z7i'���~x`j8�]A���.W~����Q/���YI��I��`�-��x(��vo��F���������2T�_Z�hP�݇�K���c�����>��g@�r Q��˯�����cO�1��h�]�����*�Vw3��U[�pĮ*k{���'�_Z���$8jk�!_��_������t�>%��!XM�a\A@�Do��}���a�R��F]�ۀb�� �����h,� �*S�F��A�� 8^�y��y 2��F$ϑ�T϶�{P/ ���px�Sɳ28t�6�2Hu�̵�{�U"��/W��^~C��H�0��^�3r7j{G��ω��ˉ����剾���C|�ӾK=3o] 8'=!S���������������]ݥ���VfR$��"F��3F�0K#�������&�xs*Pk��6�~l���ߑ�t�9��]W���z�(VW�p͟bP��ؾ���� �-;@4J� �Y���e�-�}�In++<�x.IVE�[�f �3?M^ vaD����^)W�����b�r_R���ɪ!瘟i����5�X@�62���˰\�����w{�b=g,�-��.���F�a��?��G>�m��&M�T� z7>;l��,�{�uQ�2��|u1� ��N~�J�O��l���)��8"�m�?�h �p ��#">GNĩ8l��־�4��.[P Tg��ܙJ9F6nH�2��e-z�Xawҿ ���ܖ�� �r�vkJ������;���H��]��^�����)?^"^��T�M|�܋���� e�ش����,4��A��75�c���ɭ55�����)z� �w}+[�$P�����?L%]����)�p��M����q5���X���B3lv+���-%���g�b±�TT#�� R����7U݉�r@�PI쵻��H��mzP��5�|��x�־�hX��=�F3�@ �ì���|���l|$�~�K~�;DX�Cwpxp�V���M�rP�%���
Behavioral task
behavioral1
Sample
Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.exe
Resource
win7-20230220-en
General
-
Target
00031-00068.cap
-
Size
3.2MB
-
MD5
b71d182debe6bae77e67b67ce681d050
-
SHA1
5f83aea4ed2f559ba030ec2c6a205d0e80abc5fa
-
SHA256
30133b693f2007a2edad6a2ed4548301c9eec79c952977a21f7e202f65765b18
-
SHA512
fcd6d8de6b6b251e38f7a56cae88c9ee60bad33441458e017276850eb491b926039e9b60a664fe4925b5973ad2c9fcab153c201ef5520c7c4a9f672174daafaf
-
SSDEEP
49152:7Mt82aWk9AizBpAgS3bbFXPHiMfGaUoc4MlOXdcOkMb4GkXBAG/kZmGFaUZ:7Mt8okR0LbFKCGbocxQXdcOTbjUH/PmX
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.cap vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.cap
Files
-
00031-00068.cap.zip
Password: S@ndb0x!2023@@
-
Device/HarddiskVolume5/Program Files/Tally.ERP9/capsules/00031-00068.cap.exe windows x86
Password: S@ndb0x!2023@@
e6a10b1097b1b1546a56ed1e5939d61c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameW
gdi32
CreateFontW
wininet
InternetQueryDataAvailable
shell32
ord190
shlwapi
PathIsRootW
netapi32
NetApiBufferFree
ws2_32
connect
comctl32
InitCommonControlsEx
advapi32
CryptGenRandom
mpr
WNetGetUniversalNameW
ole32
CoInitializeEx
urlmon
URLDownloadToFileW
crypt32
CertGetCertificateContextProperty
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 550KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json