��d{�� ?����!��i֟�K����p��X}>����T�Wo"]<F�]�����X۽���4������a@��3��g��̆{Ԍ!��-��L�~�;��G��Qv&�It���a�){:�g�w&��U�{2z[�7�AGhq�D��S�vm�6ށCRr#�뭲��y�֘ a%���hгf�>��*Y�����*���Y[�����x���6�dɐJ_�k�ψ�@�$J�r�������~#)��|4b���ۡb�N�-�4O��<�]�l�Џ��ˮ�+�,?^|f�d�mT��9�R�wi@�@�F��}T�-�K@7��~6��կ�g�v+��z�ʺ!z��k��T��}U�@>� ����P�U�?m��ܺ�]G���F���S1��y̓�ttܵE�yNfV���t����<���p�[�$�\=(`� ��CvAd���%EU��P�C��}��JQ��p[Q �|�9i;����V���lV�Vp�I����r�5��̰@�N���8�ȏ'G�� �r9�Zo�:��1���l��'iI$�� ���~^֮�2��n�@,�RQ��ܔ�Au�{���u0�/�37m��p����e)�1��Z���-��t�5�^��b�T}�WZ����_Ɣ�V�k ��b�[�n�����;��Y�6q�=A���97l��֥�+R&�/*�����ɞ��@)YP�KOe�������197d�=ѽ�� _������O����g|���|��%��J������|��/���b���Q,�Z_ݟ�D% IgE��l��Ǔ�>d.n(�Q��U���B�t�̺ʮ&v;�KU����PQ��)T(��༄7��F�3���/��u��~}��x1F�w>�8U=^���P4���άO�g����Q��i^��|t����������d\r�����ӫAE�A�ҩ�0��1������e ��`�of�N|���w�A���x�g�����9W*��]��Z�ͪ}�����ڗ�(87͋��S��`U��8�*�Kf��P���6�.S�3�c5j��(�Aw�5��� ���,��N�;L�;�?Y���ᤁ���f��'�e�>>��$Q`Lo��??BKw�V8�M��m+00� �\g}Q[{.B��\��Yݟ��=�����i@L�C���}�i�.$",��D��$K����.x<�& e�K,�?�8z��1۷Y�����$KLZ�J26X�Z������� |,*-$��o��:�������۽sB�@ �|{t�z��iV�ߛ����N�n���餷��Ή=\JP�#íM������+�]��|9�������Nt���8v��Od�~ Ҥ)F/�.m {�����D�o ���`�_����0���ϔ�Ď�7��m��&��8e�<�'y��!��X[@)��Y"ZA�~")���}�2�7-4KW�����:�:��z��3���R?*�T���XGޘ����x*�����:����*B^�`���O�U�S�_�Ր�^{��wF'S|�/"�U<��u�r�NZ������#*A�P�Tz`�?Ng!��K�!yfBB���g��>��%�G�yU�ds)h��Z�^����ĵ�0Λ�Wz;�]֯H�����)4>x��P��]��tf@�w:�eD�*t����r���'�[=�I�q�o���Z�K1� ӕ:Rr��侉�+���W�� o��Ao��3G��{���"�T�Gf�z��~4���*K�-��N��C��'xdZ�\+�f/$�I�@2h��14^�g�O;���o�ޖ�("����T4/b]���j�q�*Ŕ�N|�����~0$�;�Ψ�Ps� �6�c(4��� �+�|#���o?�D����Zߣa��t'�kq�|d�큏A&�Ue�����82���['ku�FT����J��*]p��)G�'8=�FT�ܾ�>�T�'?_������qj),��j���̩$����w�4y��>{�`(�@9�p� b�����p�c��)��Vd�2��n�1�l�O9� )���+pI�5�mt����(� ��(��ڣ�P�m���K�}RiQ�H�XE��e �1D�B�bb3���W�=��"E� .TZ�P�ڍ�6�^�����u�g,Dkj~mH MEп'�yZ�E� ��%|mEΚ��Hq�E�!u��K���~=��.4l�L�ϬV^���N�&|����˿�̤�H�p�$k�p.°� l�Ũ����*L�b5�أ�R%����{+1�B��\73_lo &S�Q/Nm���q��Y�p3 �hu&z��DZ'~3���Ȍu+��ȧ���C��E��Iz�����JDcT�a9�;��A7���P���ND��C���F����p�L�ƽ�Gi�^�F�Hg�����Qq����7�-� ���4U���"S���{@�>Wa��3�R���|�����'@e�K��C���Z7ط��G5��{,�N�,������a�*��<�Ռ������A��R���p�r`n�8���QD.,������*l�����z�)�ʡ���H8��&]o����\�MP�'� �)���S�sۗ"�'(AM��Rr �wӟ����q�LU���(���e� ���⬌�ϲ��N6�0\CSxg�b���&��D��W�:@1͍�ڂ�[�/���'����>C���RsJ������~̙�xp3�`j�c@umc�#͆�bPKˆ�Q��Z��6w� {�a[��T�8���������^��$^��Ղ 0�Xt�2 3g�䠚>Y?�0B���p�����N���ݷcrA�i�"��sdG�O+C��W=M�'u��O���G��+)5���/n9�~-�w��sz9}�7tغk4���@�4^��-�� �i\K.��L)T"P<��eW<n��8P�p�l%ٰh�:��]1O~�&w+������6�Q��Ai����i��I[���4��ܻ��y�X��ż�z>���vvW�V����j���}���hCdƆ7��'��<��Ъ����8��|B{ϳ{ɷ�A�>�}�P�bz��$B6��Cܩ�u'.�TB
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10-20230703-en
General
-
Target
Launcher.exe
-
Size
13.4MB
-
MD5
a59e34ee209cb8fe948f80230ca990ee
-
SHA1
522be1180b7d9a69d303a37b7065b735d1ef7030
-
SHA256
c6e7cbf1909e9bd738fba8b6a794204e4e62a55dd2e54e9ce5c2a15f42a2c7b1
-
SHA512
b4b2ac11742c6ac8eb9dd814eac60057859d91dcf901917de7caa0d74cdce86b094fbd22ea4f885802d056a174a546cff507b0169f57fa2c5004f298866e02fa
-
SSDEEP
393216:PNqrvMrVTjJ0ckbpslO84eGWVD7AZeU2ZJ:1qrMrV50ckEOj6Dc4U2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Launcher.exe
Files
-
Launcher.exe.exe windows x64
21aeb75fb9e2a8481da0d711ca671e0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.3MB - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ