~sݶ��h�BS �r��_��U1�UKNL�����&W:[ڴ[��6o� �u�M�Gn��k�1z��p� V:�L�)W�y)��dwpT� Vu.!�����x�����6b8��"`v��S=�S�����D1��C�|[�����{����<�j���)�^�Zꄈ8.��u�����pAe+��!����K_~���J�EŘE"�D+$|� �R$BJP}��U��q� ��}4f�Ȱ���� ��!2`"7�>�Hƍ9+�_o�~���K̰?ȫi���{� W�`��CPv����$e�ML5���|�q�Z���۵�35�U�� B8����/�^�v]�E�{0�<��O��'� nd�@@ԋ;� �v"6��;�q��<�P;��h��dھ"bH�)�A �ڳ ߲^��_���)���5������Tv&�櫯��e�}��4��o@:T��\ޒ�i�Q4��8���n�Cc�r�Fn[�dл5����Չ2�-�u�F����~ ��#����7)�G�ɓ+�3��D�8e�*O�M�<[Э d�oi�D)�k��ʐ�0�s�����|倓�H�븴K�B�s�uo1P3ق���FT�FH <H4�DdT��F�X�A��i,�\�&�5��x��¿����`��&�њ-��d�ef �Lt�u���b���l$���Y�� �䖅^^ΫDĬ:J ���'s�#7��>�4�(� ������_���?D�m����]�B��h5i�+ �� $N�&����yV3�&ƕ��f.?�Hp���=���[�/�*E�]v�2�ٙn5�HPli�5�N�(/�J���/���g����^�v¸�VU��'��L:95��}H.�#c��^F,$�6r��<,��"�~�� _�ǰ��~ͺC�I�h`)�j���;r!�xC.����A%��-a���C��8�,�)�Z�U�8���J�Z���l*!(t�����.�L��i� o`}�n��u��3K��'� �x��v��k�rY�{bZ�>s@u��Vt��l^�VC.�����mP�%E���r�_��zv�� U�Nr/��PV�t� ,�&��۰�x�>b�M[����2G������c�d���@@깽��UvL��*}��o1�M $2��9����'`����J�H>��0�U��n�C���!��~�u�Ʒ�u�y�b�x�����9kuy�U��K���A��-��-}���g��g�i�B�[=^S�w��գ&\�����;���P���?�U�V1���Du��Js��e�0��Ս�9yV&�?J�6�֠�S-fځ��p�M�W:e#��2���Dq��M� �����3��U�C�:c�a�j����j��`ϫv�2D�� ��2͙ՠ��+����_�m�tq�8. �Vm�~�JP\.(��7)3�U�eB��x�� cqC��?��%�b�t��L�7�j5k+�ѽ:(A��w��6in!,���V*���c@�Ɵ�Wָڞ�6�,n绽Q�T��y�� �[�� TW�g���� .?S����ws���+������14�º�K��JԬ��q ��@���kK��Ͻ8N�O��`�A��s���:*�~e�����t���TX�H���r�n�-骖�Z��T������f�|oC���#�ti�.�Zk�Z���F��_W��ŊV�a��n��~�?��q�緵���j�f�d_E���7z��#����!��|��-deH;���I��s���}�f�Ʉ���,؈i��ņ�p�R):@����^0��5�����z����n8Zwŝ���$a r[]��P�(��!\$�C��p)�9�|� ��w�`��x�4|�%:G�\����R��=i�����Z��w��3��91���cV���,��Y��zsI�Z�RqqZ45�G29q3d�Y?0R�a���~-����G���4 X'S���Z��^G2�zu�Z����0�Dsm���p�Yʉ^�Ul���Ŕk>+���M���Z�gLf��x��M̒,>�`=�OT�b�83�Mo?]���E� ��������l��2/�[+�� �f-)�\b���{������i�b �p�ƥ�~��5c�z@�!����i��ȇ�Js�@��8�n,4�?Y�-Y����?�V��)a��e�%�*���u���bX��p���� �I��H���M2�Ѓ3Wov*��,,�%K�5=���������l>Ԕ���O� WAXκDKu���K�%�Z�d� ���5�+��D�;��n�ց1���dz�C���'rl֍D�����s�3{�-uΝ��S�h&��{1�^�H���y2�h�C#�^>�j��;֊�������cjy�+~�ҏS~�ۣ��禿�V�nK��Bs݇hD�-��4/J�'�e�Fb믕f��1���C4p=o����WC�^җ1�����X�`�f����\ˋ��_�a��ވ�^�Ǎ�M��soO�EŮ��iC=9Li��jZ<��x·�d^���@aN��ķN`���>G5����h���L8|��a?$Oy���L�N���)$4Q�l�m�dr �d���;�:�H9u�Ӯ��+kj��t���תo�;���l�c���M�<���� �h�p����"L���j~a��֔5�]��&�~�v8m�z��� �.�&��\/�nۗ���Sk���b��[t����M�䷊�Q$�X���� �� �T����������1tM(�6d�1=t��=�:�1UºT��^l���{3�Y(�'Ԏ,��� �w�M��w[���0��f��+���%܃|�x��<3�z����������tW�s�Dv��y�Z��7�}�2?�p�ᠯ����4c U���)� �����GE�oB�� vk>:�W��(�JC����eO.+� %_%���M���6'�i�T|�d��z�%���X�)�r:��*l���\��K���8���y������ͽ�;W����i ��RF�Vp�WJm��j�߫��n��Vp���N|V@�Kd�/1��
Behavioral task
behavioral1
Sample
egdeyaa.exe
Resource
win10v2004-20230703-en
General
-
Target
egdeyaa.exe
-
Size
8.7MB
-
MD5
bfebd746847f565d8e003ed01f7b0824
-
SHA1
a9cd87c99b731da147f39276f948035905b30b4a
-
SHA256
efea7444233dbb3ecd7fb3cd312c3d91b2b06ddde6eb1c63506c0232f9cd64c5
-
SHA512
1942757bcc92ca3d0b30360d36cffd08355124144faa4ef517c1e1cdf7f72250ee62997c0c35b36320d8e613a0c0226ed49e6d7e73321877dd371a7f2b2507a7
-
SSDEEP
196608:8LQDSb6JyVXS8/jZImL69auLEMhvFI/UVCgldSaiIUpFO15wIEBf+:oQDSG+XS8LZH6x4MUICgldSOUA5nEBf+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource egdeyaa.exe
Files
-
egdeyaa.exe.exe windows x64
364aaddb0a1b17b2fe6c0b49cc19039f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WideCharToMultiByte
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
htons
advapi32
RegQueryValueExW
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
userenv
UnloadUserProfile
iphlpapi
GetAdaptersInfo
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ