/�'�GU8�� Td�b5���Oϱ��p`�p������c��$�C�Ņ ڄ��z}�l���"r�b$5�{��j�G��,�I��8���rN�xj2e5�H㥚�p9b��"���u�)�|�=��m`��U�HiiW��#��P�]����A�$�@!��^eh䕒�H\�@��`&��o�:�=�\�<��% �ы���f�bgc�.�|ԭ���.�"Y�YK�T��&�{����a�!����F���h�y���Y��G&?�Q�S��o��f���g�G�����k�+��A��Sf#�6S�'���6�B��N2�P_�K�r���qp��w"�Zp��k*z���u��� AvL�� �5����M�ό礹.�lj>�2��_jpC=��v89y����4�T#�����&�tOh�d+Y�RY���,Ѝ_�K6���Ǔ+�̶���/��Jw��LǶ`���H�'��}%�"@�Sw�C�$ �P��ʄ���N�,��^��iVq�/�yi[�E���?d� �)�:��G�+C {ӌ�f��g�����k�G*]� `�v�[�Ue�v8ʬ���� ���V�4�9�[$��O6 ��ɹզ�.M�t�6�b:�z4�������R�M��0"1�m�!��$f��~R"�ˣx�U} �� �.N߃N�VRӶ;Bo��=t�=�p�IT���������� ���K�L�.�z:/2�v�]lIނgv���8��V ��B/(����X���u���ȟ�H�g�q��/(+�\x� �0QM��������e�N�hd�������DQt��D^��������+.��9�(�T�� S�i����,�x8�-qm|��y�o�JA��N�=�{����D�τ��Q-J_�c��9�9 �H>�Ou�s��j�>� <-�������S�Ⱦe�J?9�x�u9���-i����C�e�����3z������9��^ω���ﶳ���gT�q��Ed������`MY�oG�ǰ1�dK��B)<͚�����K���,Mb�b�uu���-�e1gO$�Shw@�d�6�� �6�^�Cm,y_�ֲ����Sմڗ��Q;a�FC��v?��ַ�<@cY�t$�)0�ρ��0���H�^q4WD܆ʯ?�d.��� ��eI?�1�TZ2��"��f���X�M&a��?ή(ij��<\��<��E���Ż�<7$U�#h}�?R����y]��P�[�-�o>�8�&�w��N�&�ґ�o����4�$A�U:� N0x�s��[�#1nN�]�E�Ś��6z��i^f�N֦nT��Op��LT����M'���c)�WM�,26����7��1�p�m�]"����!RTz��Uٴ/����yډI�gY��L����&l�i`����x ι�$��ѵ��d�9�� R����w�+E�����������/w]�G�|l��_ D��<W�����qM�I�!�7��̨}i EVNH�?e�!�/�\���Y��<��qa:ǟ|�_�kA�n�̞�I��M�>�N�r��:�A]i��@n0�y=}��<��C"K�zgb69�rV s�B���Q�<��ʬ���U�v�RG�ڸ�A�?A�%/�5�d�@4�kja�Z�;B��ݽN�T?f�� :�s�c��!ۻ@�e�]p�"1���g����c}��j�q1��H�l���Y�i=xp�f.E���!�����@f'�7n�7�uz�a�nxϚr�F.J����2���BD�P��\���ȯd�}3w�%��3�Wx�,/?�[[0�c��画���&�0D��g��k� ���3y��,=F�F����W�C��,���T�n��E&F oǞ"��)��b� CĤב̄�rՄ�J���͌�M�㊖$�W�:t��ρ���Ub���V|���v9Y��@��k����O��'�=�fOX��87�����Tx014�(v���:�CV����mH�׃���/�v����V��6Q �L�7��3R�9s�fP=O��5���o.!i��������D���LNDC"��(�g$%�����s���`TX��մ2e�4��ܓYL�y*%���L����J&����Df�ǰ�®6�"�"���������.���b�B�d������Z l���)�����Sj���W�Q�A�]�0 ;\�9�?� [ �9�f�ZB"���y[m���,�K�2��\>w���Ƹ�+������#YVh���q��_(9�5�5�1�U� �l�X����2�������Zi>0d`A~G�$з�H��V"+��U�|ӷ<z�:[HN���jTˤ�iͤg�:`H�!n�����A��f���lKUM��[��C��-K��W�}� �@J6��j�62,�ʥ���Y��Ϸ`��[$�-�� ��c<��QJ5*��w�kq�av�AyID���x�klr���<JۥqW����h��:��K��[W���}��h�[>U����a�����T}g��+=��'����%;0��kbD��`�+�_9��/��Q���_m�����sI�?�o��0����P�6I�9dO���K���ʹ)1�2� �?��)䙴*� G�����N��2l��&��s �0{�L|5�͉��.��L����ݐ�I����I��<dؾ�D�,��*!�|��IH��Tt���9�,�����������HL���ٛ/�h�@4�f���B���%w�"Pp� 6���iL�b�,Sml�N*^�u7�@�`�#ˢ'�c&0�r�BN)��o%ʿ���b �f6s���r���^�lU.����'�>���=%A^+�����yp��]e�L,���_�*h[.V�{� l������gKئ/�0~��Nj�i�}������$�������OOR�a�M!�����r�� O /��>�ޟ�T���4D/�������ln��::��5�f,Qz�c"5�)D؎i�Y:P]��T�k��r{K�h�3�Pp�&��/��O����0O�����,�դ��K������;�:.��.Y?�Mz"��^t����UU7"�qNa�I���=�¿���LLݏ5��Q��1���F�ya�
Static task
static1
Behavioral task
behavioral1
Sample
qVw2eBsswcg.exe
Resource
win10-20230220-en
General
-
Target
qVw2eBsswcg.exe
-
Size
98.3MB
-
MD5
3b5f6b83172a4092b5b95565f8df59dc
-
SHA1
b61e4be225edf2afc21dca767029daa97abc675a
-
SHA256
1684ec5994027c12e154d92c53e102145eda70b4f9ba093235c1be78bdcf7d6a
-
SHA512
40a11c89a356a3bbb42af1457944a502f8c3b79fb2de19e355abc379cbd3a40d606a1c4844c57fb8122eebfe12ef643fda6c2aa804418f5f5e9521663f049a95
-
SSDEEP
3145728:YofxM4lcANc5RTQKqgJhd/d/9I19xgoy:Yoe49NM0gJXw19xS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource qVw2eBsswcg.exe
Files
-
qVw2eBsswcg.exe.exe windows x64
7da764ec5c41bbe81c96e1e6837fded6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
CharUpperBuffW
advapi32
CryptGetHashParam
msvcp140
??1_Lockit@std@@QEAA@XZ
normaliz
IdnToAscii
wldap32
ord46
crypt32
CryptStringToBinaryA
ws2_32
send
shlwapi
StrStrW
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageA
imm32
ImmSetCompositionWindow
xinput1_3
ord2
ntdll
RtlInitUnicodeString
mpr
WNetGetProviderNameA
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_fdopen
Exports
Exports
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 93.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 98.3MB - Virtual size: 98.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ