|�U�MN���s��/�6�0ͩC�ML�4���� z�ɍ���쿺DvkM)"�T|��F��1�����Q�ʚ�F��]@ݑ�F\�ɵ���"�̩4t #��f!�Id�8}{{�ߡ}? ����~�b�&`n�Qw_u�Tm�]Ѷ㕯y+0��%�=��kr� -31&��o�=� ��0����A�@nW}wU�)����Գ��rqcy��tI&�)�Ȑ;�03�+�~d��Ȇ+�� 8����d^X�\"�#��`J��g\!�8�e�����c�F�"�P]����y�wlC#�|�Bg�~:�%NE��������Ϳy:$Q{ؕa���3��Z-y©��&�V+g� � 5�7��QX�N�L�Ӛ��M��F��=ݭ�?L8Nd��.r`ngB����&cm%ii",/7R�D��qq��32���6���MF^��Zw�c�&=&�����f=?{<�_�5^��Їb�l��/R���E�W�/�����3�t�#�h�2��~ ��Wgr��*l���o��gqW݇�Z����QEG�l����RR���X�to�� G�V�.�{�|G@�7v�E� ^Do`�u�QA[ۉe�a�Svl��jn��}q�Y��?=��#ݪ@��R͊��g������Z������ur`�H~a#q�8+X�Q�}���[cd�G�ܡ.ȍ>��"��)��P��!v���svw�48Ʃ��e�>#r)�~ښj�O����3�A��U/�=���hKG�����X�����y�q���6�=���p���οo��Qg�.����2�#>=�@)YB�?Q�2��B6s��j�Z��iE&�I���5uQ�OJ����@���m�DO���"���$ ���G����|>�`fMZ�S%�Z�� ���4� |�6uX������ilc���(<9�mL=�b }��d=��t��;��⻎��PA�i�����Ӕ]4k�Rt��/��o�`�K'��'3�k���VX�W :Y��l,��]~H�����?F�߽�v�a t�����4�D ����W�(��k5UF-�i*�%r�F��C,��Oibe��)�䛝��? ϱ�[�� ]��{�R9*�թC�A��ϝ@�,} �g�Tz����-q�EO_ �����H��|�i�>���*8R}x����k�/���x�K3�j\��w�/�`�f���t�M_[��3%ٚp�U��(>��-n>��]_��ӭ{�:S� -���-��X���G�:"&���9�96�+ȗ�x�`Xqfܤ��xo���A��Sf,h���A��RS�{Q��������#z�m���2�bfK��'��/p���*H�@�5S���4���V�͔B��<f��mc�W���u{�v�I��Mp= '�t"���F��%��W�����,��r�t!�&���N㉬(��r���a�Խ�g+�K2���v.>�ýDW?�Iw� ����� ���RY�+p4 =�R �^ ���LB����B���X�w��������g��-5 e����_�� #u�px�18ͩ�l�'͐6�ո1ƛ��<c���:�|"�]��*��G��H:d���] �w���8���І��{�GU���X�@*�"�[=����`o�X�Xo�V������N#�!%�k�ܹ;F��}h�2>�U� Se�K��u�3� �ǫ�6���s>px`��s�O�$~&K⡙��t�����|����aAZ������I�X�Y�1����:���RO� #��,���$�>��P��t���JX�G!�p�WS��� dz%�;�����jQ��gr%{0��|�AAn��*F�K� %A�E�gm�q�8 �g�I��e�Yߤ�B�;E�,e?�ollNo<yl˽������ս\�1+'� �<!��h�U�L+��Ͳ >�1��i�� R 6QQ�PS���A�ړ�3KN 3s��M��jEQ(�y �d`�Q�7.��� g��ȱ�;��uj�����'�#ɜ:$Ƌ�f����-�������I�S���:J[�NC=��J�l�_�X�4�Ʃ����-aP)�?�tT��۩b��U� pp���O+���2��%�|�,2��.�^I�_T2�n�B;e�t���;���k���� �~ ����:�]~(h������z���{��GW�͈�T�Q/t$� �l����ՐpsJ��;BC�~��c�Yt9�m���4+�&'NC�b ��-��&4* ��Pl�����3�B�G3��j����͂�'ldF�j%|w���@z��yF��9����YW��i�� �&�N�����2�z��]�FZ�z�P���Ѭ��|�b����#��x �L��L ���*y��^[3���0mь%�2���e��������Vhf8���E���p��j��Ⲕ������K!�\�ð@�%�ѵ��K�\,P��łJ7�Y��%E[� 'M�͆�[(�>�y�Z�>�y�������8�v�=Ӟݎ��P�N }�����'�h�rXџ�(W���".���2T�ك�l_ ���F�ו́�6��� ��ڼ�P����ׄ�#i�� ��š8u��EM��E��~���C���sk����-6�&���Ҭ^������+(pB@_.�����\C:rI�u*���_"��}�ZM0\�f�� �%���z�n̏�u ���=��XjA�,O��9@]baX��B��U:�NRbf�g��b ��T*R3�b>D�O�r?���π�brS�Ef��Sύ���(�.kw^ ��O��M�?mB�qʀ�I�������GV�M�������aG��jr{%&�(����� ��<'��'̯*+�G��sɗ@>��NrgKj1�&~�<��0�5���|�d��V����-a�D!�Α%;!i��Z����:mn�ō�嬚�tP���2�NW\Qzf�HH-�Ngɑ���\���5�:8u��v^������l]�M����G��$���@!��Pfp¦1��Or�O�gNoc'[s�㫛Ē8E���Q3)9-�4�6D�a� >��7L��]hW�\F1��.(�|��ƚ���Ō:��}���9O�b�Ii����"%yj �5�
Behavioral task
behavioral1
Sample
install-setup.exe
Resource
win7-20230703-en
General
-
Target
10101.rar
-
Size
6.0MB
-
MD5
fb39f8d65bbfa62a5b779b159b386eca
-
SHA1
37c9e48d20cf47f58a4a26466eeaa29f2be74bed
-
SHA256
86cb10e6a921730bdec457cf1ed7cc7d414175c9d3cafa24bce3b7c468f6a028
-
SHA512
46c27ce8686c88af77d9b22e64b2d2563608bcc0f026a5d8ce3df347322d27b6f694c21b34a238502e141f93520b7ad88eb3a2f9a82ef7431d59ba81e51a6135
-
SSDEEP
196608:PzEfJ118a/C6ixtYtEgiQ8WC/0bhpswAhg:Aq0C642EzQ8WGu
Malware Config
Signatures
-
resource yara_rule static1/unpack001/install-setup.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/install-setup.exe
Files
-
10101.rar.rar
Password: 10101
-
Read.me.txt
-
install-setup.exe.exe windows x64
Password: 10101
5893e69089e19900fac24ac96df96468
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memset
wtsapi32
WTSSendMessageW
kernel32
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[0] Size: 784.1MB - Virtual size: 784.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ