=�"w�: vj<��ťzX2�楧�1j5Ez9���1�,��_���8�.C�X����8� ����Ɵ���=�ХQ��\-j����i�<�[��1i;�#�؍΄��EY�v��2����2�a�uo`x�J���dD+qD�9��d������z.^�>R�|����8�G����$0w���^X����]���~d�f�]�粿v�9�d�O�k�OUZJX��%����\}�`�+d2�#I-�/C�$�E���� j^��| L�J����S.��:�k��%��#��w�a���"�x��܈�m���R\,�m�Yڷ�o4�����E���.Ѽ�?��&}P7�?3�I�.\M����8��,�p�}� Sq�����MK�k��F�ޗ��@�2�2�Q��\V��E��K���h�H7~ȴ��pvyz�Za���v���<)�z5������v��ȼ�'N�����J�ex��y����?���s YO�i��r2|��BW�s=r �WH�ӟ�U��Z#������II9Z�!�3��R�XG�����(Z�J}%��B��=m�ū䰿�M��7����hP����hQ��)���G�h�2��܍�e��/��b:��_���8�Q���o����U�4�ʱnw"O��Q���5\�cܧntZ9`�%W�Jy]o���p��]�m"����v����=ީV|b���I2qZ���ϟ�R9�Ҕ�< f �S�>&����<4�+��Piz���+�~���b�ʰ�)1�c1#�P ���!���@�W���|Q�&k��c��3^K;��C�&����}�Z�j��f�+ K^��+'c�h78�d6��v��I�4�/?�$>�MQ�4�k� տ�p�x��C�3����Z R�ivh��V�gCy� ��x�66O�S[cي���Q�G��o��|P�S8�#��1��y����}��L���Z�],#�w��D���ǷY���ĺ��� xP*n�lV��r���qI��w���8~��w"���) Y�"Q�6�ӓ�����U: {����(Im��! Y�kK���t���^�~0i�3�br����j����gr�;H��MT�77�agx�Ӿ���r����Lq?ƥ}���MOG~k9�+��r:����� k~,L�~���z}��I�V������q, 9����j���C՜�A����{�6�'".��xu��fZ�\�˶�I��c��_q#�S�ǩ$�du�R=b��D�K��K�U�l^�{��1���A�z�7�ρD9p2N��Q1KP�mF�'�3����5�k��I�Lb��Uj)���&�p�d��%����!�;a �C�WJ�+cj�2�f�I�0�7?��E��.��1/�L��;��qAyP4g.���Dv�,��\]D�p$zCaӱ�L�������UuC?s&6�^o[�X�6�ȞYG��C:���5.���/�q�j�:F��AG)3�>������C��36'�>/��(�L [$p�}]Vf�7��ǯ�^]<�i*��S�r�8y�d���_�3�^��W�:qM��<:qﹹ`�`����Vݪș�or�V�d G�Ήg�����oG}Ø���c}����V�j X�� ��tQ��ME��'��}�ƁyQ��yh�l�[���|�)����2�W83>����6��'���p��^�Ο}�[ Q7�uzV�M��_L}�����F}6�I��L����/S29�o�� f��\I'��xp��~��G@ܝ�+u07a��؟ݵك��g�X� S����F��&땢�j�̢r�?�>�LaFt��cGm���'��� J}�z�J�'��,���vF;F��k��n�u�����֪{�G�/TEf'�6*��6|T��ޱ��,��������� ����p��$���i�o������� c�)2�hekMT�7�U�L*�e�8^��=�!^:Ias�0����s'�Q@�X�̹X��b�-�D�B��.|l��è�|�y Ǿ�����m�����YD�ᾭA���~�{�t�7d���kq�S�_�2y�?G���Q���q����^,�E��̾*�Փ�0J���7뼥6�d�:8���ز�is�EbyȽ��f��\�b;����P�e�gX�S�;/��f�RTU�K�Ħ����Lf[�S鱋$��p3b��}@ӆv9|I�ZWiW�1 � lM h��χ UP�L��F��IF��m��� �&C��HL��qo��� R ��p���ӕpSD�n^��z��_2�ƶ��p���mJ�M�=��1�nr���o�0r�����"�tz��9'��ݎP ТҦR?�D�w�%��t YX���iU��D�0�U�\�ȩ����^�m�~j����m0��! P�Xpsrto�t�\�S#}�8�G�f*F��h�/�7��>|����$#jϓ�i�<�\cY��5��)O����F�ݒy���թYE�9��uڳ�z��xi_z�8������6�bcs����I��iq�ys��$�"0=���[�Jp6yt���{vY]u�B��c�T)�����i���P����WL�lt�ZC�f�����r��\����=��1��诚6���U�����,�A�5*�e_�M��ѻVY~�\@�Xt�0*�mr�6�F)���0�����zǘ��ˊ���& �BL7��݊���7�����;��e�$"���s.^��@��K��4�Yu��1�g|��[[b �����l�,�������w��������8Fq���a~M��]z�z�� �xT��<^��0��j�M@�>W�2mC�y�(D/2��� ��C�s����>=R��[�h>���i`sB+U1�Z��c����e��%nc5���+1Oz�Pȷ�a&�X��{��P �|n����ae��E5|1��'�bI6��*�Z�����E<��Ѱ�����������Q+�,$�%�g{�*�҈�{頴Jfϟ�ߍ��f .�)�����V��E�,���l�q(ݭ�-�Ȩ�9�K��>F��ˀ[�I�(O�f:�J{2��Ds�Kv
Behavioral task
behavioral1
Sample
Launch.exe
Resource
win10-20230703-en
General
-
Target
Launch.exe
-
Size
20.9MB
-
MD5
036d012dc0c9d1b185e7ebc112b56703
-
SHA1
fe04446011c494a2a38a73a17e314f1c9f05f76f
-
SHA256
efbf3d3df6a761bf03f252c385100ed3bb82da1daa1267860c978e17e707bf1f
-
SHA512
f6f750d9873a61fd8d6993014ac3dcbfcc12a7372f86e8ec2009fec96d65855bcd037cac945a1540b08b74a7533077326cad129e9ef8aebd80026d58f6a8baf6
-
SSDEEP
393216:lHucF8ID6CbSA7wXFwzJ8MGlpQDV3xNmIKFH9f3wnd/2XhgiP79XGt7ApfSEZWpY:NAASA7qizpWpQlxEf9/w2Xhgij9XGtsw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Launch.exe
Files
-
Launch.exe.exe windows x64
fd8d2798e0357f1c5a82b1a42098f0f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
winmm
PlaySoundA
kernel32
CheckRemoteDebuggerPresent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
imm32
ImmReleaseContext
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
xinput1_4
ord2
wininet
InternetCheckConnectionA
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
ntdll
RtlLookupFunctionEntry
urlmon
URLDownloadToFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sqrtf
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 689KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 530KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 20.9MB - Virtual size: 20.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ