�4��d>���AC����JҖ,!�%rs�����_��"5ˤ�]*�R��/�H��[��L�62uc.8��)ĥ�@n9�ѪN9�5GAF�Hy���y4�O5:������<��\��7�p�h�m��x��_įN��ϰlrk�mU,3��vf��y��n���}����=x���CcP+S�@�X^��� x���X`�H&N�#��rd9�V� �%�=>���*A�*��+����Bn���J�*ͥq�@,̛��|֢.��Ě|�^�o�DZŁ�z�w�m%�+W?��P5�$T)cw��*��]ݶ���S� x�eC�i?��ɯ<"�v�tM���կ��L�]lX\���y iǨn���d=�?Li�������y��\{!��7i����Cb��3�+h`W��+�$_�| 8���kjoj�� �.� �!���ř�bN�YB��Ƙ.!��L�D�zu��?Җ�.�#X�!N�9n-����1�A��ȍ���^Օp'*c�\eE�ol�`HĹh,��q�DkFHr7LUUS2MJ8 �yu���{��/Ri��o�G?�0c-���]��o;��n�2�ꪸtYG9A��D���ۼ�_<��xo�7 &�B�]��W�~tk�8�w�ǩ;@)�0�< +�*�1I% C$�N��,R5�~0�3��\�W�6_��*+Xg9���f��$W*BMڽ��f��‛K��A�Sw��+_���~ȉ/�eAz�p��?���������� k����P�z��%r>�)+�@w�!n�!3y�F�|��3��B".-)���d�m�J��D�a�$wB �Z�R%P���~�bzݙ��c{\�,k'���a��'M�`�^�ʑ��L�t~u c�J��.n�}��m���� ����+v�"��(r��[�)��0�|-��8mD*�A�[[Y����4�j�6_��鶆�23�t���b5 �uk��&�z �����M��`���7BAg�<] 5.��ʆ���hF^��2��%���E����T��J��թ2��ξ�C�箐�HH�L����t�(�ٖ�5y�0�(@�R2�2�Q�>b�9q�1�F!FX����ݠR<����6������F��<ä���q��ڍ�,a�gål��rJ�㊯�����mD��h;k}�hVg��F ��� J�{J�'�gz(�g�o}uHl�s���tJ���aB�_ {��H�v~�ފ6�R�"�L-��������~E��E�<���@���Z�d5�fбh�����u�W �_���(^3]n�;�E��zb����.�n(���74D�tY������*� ��nǠ��u�����i�n�5��Z��&r�"���Mh��3��B"�5�xV����9`.������pd���?��B�^b�({x���O>��(��yXfA�I��Q;6�J0���p4e�8�Q�� �LR���K�e�M�=5�J?D� v� �4�l�[�F��o��4e�EϮ{[��ł\��41 �Q|>�k�Ѧ�ߨ�A�`����-�B�[::f��hW�~�d�]8����뺸us�W��jt��"Q-q� �G�x���`�$1�}�=�X�Bs@7� �𗫔�����o�{͜k�e�>{B��o6bS�p�A���Ǿ���7e��D��_y%��0�$g�1�qw��9X�ZL�Y�D�*om,����ђ��(������F�i���l��ŪJOXf�Cv59��:l~�9�%Vڸ��T��V٣�;�{���Ư0'�ۻ���暎���`�R�?�?NwQ��[9S�2J0#���`:G^�Y9�qd���۩�N��*����{��8��k����g�1|����7�l- ��v��Pt�l-/t�h���M���Uw�Q>qc2���\�]R�#�tO�H���tÖ{�~�T�@:�<�c��;�_��t���KP�\.C�-f�*+j0��Y����l����`PJ��@o����,g�tsX)\M�;a���".>�õ�֯c� �=��m6�&U��nBz�u¾�vZ�7a`L-1��(��a�/���}jH����q�I�j�>��l1�D��Ũ�V��q�F%OO����:꿥��zK��RE�'�a���ª� ��֕���E~7�Բ����%���}"�b����BB�Lo�a{�O����:T�^=����� BG���������R�MDe��WZ�`/���{� ,}֒&��V����_7�C�Ҽ���+�Ti�z]���M��8�Xn�xJN���h��Jw-�V�2N���6����Kd�n�s���k�W/l7������a�W;�g�^$/b�^݁=�w���\�6��<\�PCA�����2����[��k�U&��j���]�_z��o����u�-ɨ�cp� +�H Pr�K"y��p c�u���8���@�S�x'ޗ}�<.C��m� ��{Ɠ��K�\)~̫ʬ5� �u+����M�Aӳ��`�lp�}3,�XA��\�t^o-� ��B��؏����疑��p�v(�f����n�D"�:�7�|��}W�����T���l�:�Ԛ�>������9�ܛ�"$Q�tP�� ���@��X���ؾ@�<�� "�Y���č���%�H����Q@�3��=VF�D7���}:�c=���<Bb I�`o:M�6������ @�б�8���RO\n-KhJh�52{�5���̜��\�"�Y\�'�f���f��Hd�y�E!��#�Ԭ ��4�g��:�c�� �{� �}S'1��Y�u��`z���Ǭ���c��#�;�����:$ A�o� �|ocI���ދI��o��̓�J��w����K��N*M,U���G8ԕ_Ӳ�=���:Y�o���LS�e��nS*^qa9#��hZQX�t�o����ע���;��J9\����%�jćCW�|G|S����4g6ZV�����Ð�^W���'��#���փ8|Ő�z�a�jn�QaK�˝��sc[��.ŒY^�0ڿ��*�we$z�S����e`���U����쿎����n
Static task
static1
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win10-20230703-es
General
-
Target
launcher.exe
-
Size
5.5MB
-
MD5
8380691c9aff3496dda517ab6cef5c82
-
SHA1
53bfb83cd25ec33db0f07c17433e68b0e8e0b1ff
-
SHA256
dde95c61dbed1fe4677351f2c420187b8a16e9cf543d03d324c7b7cd26e07c8c
-
SHA512
316ef7e044a4f7da254ad86e0959637fb8de8388bcb1af2c37bea0fb6dedc2f96c76d65661b8b5d217ff05bee8c3191acb7670537bf80bc8416bb70f78b30fae
-
SSDEEP
98304:Sod+Fq4+YWL/FLLHlPbV/mx4qz1pesHvoEc5zpl9dk5Nge9o4ONS6xTLQmieb8Co:SA9B542s1pesHvZcFplpe9jONH0iyn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource launcher.exe
Files
-
launcher.exe.exe windows x86
7f11333e8f24f37627128d4754ce1acc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
ws2_32
getsockopt
wldap32
ord143
crypt32
CertGetCertificateChain
kernel32
WaitForMultipleObjects
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
CharUpperBuffW
advapi32
RegSetValueExA
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmSetWindowAttribute
bcrypt
BCryptGenRandom
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-math-l1-1-0
_libm_sse2_sqrt_precise
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
Exports
Exports
Sections
.text Size: - Virtual size: 654KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 750KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mq0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mq1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mq2 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ