��ʀ �TC�Kd�ۅ3��P�����U���n?����{�y���GH_����a����@��M�4��4� ���� UF$��L�C���v�p{+�rc#D��D����Đ�r� rN��]�۩�ce���i������Nl�kQ����<(s���s����_���ؤ[����?4�Mم:?�%e|6B�g뮌nY��'���1 �������k�`���'���!ݍ��q7M ��1�:�a���T�sdn\�ֿdAۓDž=x�bCrux�}|�v̡s�6I��q�"?��0��H ?�$w�/鹇kw^�x�\��aN b�*tݮ�2���drm�Hv����Oс�-Q�� ����k�$v�Ε�����+!;<�3W(�{]�_sԖ#%�F8�w9 �B,�����������?��P֮�r� �� f,���q��Qk:��e=���/V�����C��ϻ��W{�Ye1�?&�eK�-���"��\a�UEvOf�v�o���k�c��{�3�,��{S���~j�C|� �qM���}�� O�}�x$_[�l���($YIV�'3�8 �n֤W��Ϭ��yg��Y"5T^~<Y7�En�MGIH������wa*(-�`�W7�@J��{�z�|=�X�r! ��fc�"AP8j_I0٢�x^�y Y���%}nL^X�#x�Iᬓ�q֪v�����Z�aJҵg�~�gмa���Q�k��lb�0���� B��2��o�;*�r�y��d��l<^'�uI�q�t�={��_mc���L��g��U,>Nz�[�����q��k���L��\$����~��%DK���g��363��R[11i�}�jJ���f���MHA�� ��5���n"PZ�#�z��bPp��Z�� �u\4EЕm�s���PXԄ����A�m�Ȣ��o3���oI��sˑ��kh�&!�����q�1u9��˲e�$��/<�yj:�yMa�p���V��E��$�!c(\���Z�I��`�� [/��[�-A����U��F�+C��ȿ��]^�x�s��t�s��}'XR� a�]��60v�K2T�A�l�zS ����}.;>�s$��4�O�u�)��`_C��IKN�����wR*NcB�t���#�\)9ŎAL=zl<?�9J�Q��I��������н-�%�`'�e��iN�NAs�!�c��+YD"e^��uM���Sg"r]�e?(N+�� ���!��}WҧE2l�V���2�(�y��2��M����'�^�)��,��I�����(o'�G��?(�Մ��&��I<~��ы]�̫�w�`Uqϲ�:�No�`/��]�s��������5�X�ӕ�;|^�w_Z7�\�� C�9'��$��,yJ<G\*�����������݀��:�4C�I�!`��bztb��bv��^�C+2�[ ����v���u~����hᏭJ���B�4B��1����HyWC�p�w�@X�2t`j���]��g��Q32:Z�a-��o�oI� aɪ:7�秉̐�e�S����)��+�ux?s�B����2�/��u*����Z S�%��9TodW^�4��&���_��HT� [���JH�����5�E�x� ���g0��K��*�/h���-Y��;� �#�/`������!y�{/����)L�=*�і��)`-��~+`��V�A������j�`��=���'��Y�y����!�드Vf ������|G���FXa�|`�����xb�{�^����Z'K���<��.�#�s>�A^R���UI��V���8��1�����WƧ���ҞI*�9k����֊�'✜Y`�;i��>��#��55�m�(��Z5�� ��ಉ���l^��Y�G�Vi�L��텪ډ#����{���ǁ����&�7a6Nˢ ;0�2�2;���eX ��V?]���h� ���R"��w�>�]�Pm��/^AX\��:���+͉�y���ʯ�pL��f�z���3aTr�ϟ9+��A"eޤ�g�<.�x>2G�=߄^C�.�p7s�U����Ll�o#�)�����Q�� ���̙v�1ӱrUkV��fOj[,A_f��`����Z�b&�>��8��+���H�*e�X���Ti�T�:P���K�q��]���S�D���X��\_��pp�z����9�O�$nM�!��A�-pj��`G brAڄ�$.@��L�����Y��4�db �?�SH���:Dx�_����#�����G����S������E�T���3y��q�N���g/���OeW*3\ha�|�`m���^�T!�y��*�K�|�����xo3x��_��jc`k�k�$��B�ѫ8Z��1��S�R� YW�J��T�LXϨ��$o@��8 KiOb����T*"|X��O,9Ј�0p�� �^��m�Q�ϊ^�������:���I���l�S��r�8�D���_�4� �R����O���_0�4���4mJ`vE��D&��c���\X��z���e&i��P��X��˲ᨩ�Ɠ����阈���.�}ՙ" ŲR�Q(��k�� ����A ��*������,_w9���؆g��uݷ���40���0ɲNW���_1�֑�V���(�\� 00X��RVsD��[������SϸD���}�L=A,YMw?�!�s�!�,"�������TEbXx���ñ�������)�U�eP��{�4N,��EN�P�ƈx��ceyS����/���>��A�<��RU���*gj�# +Ȥ��k�Iވ�7r��}M�ՌM!d���1�B�&+�Je��i� ���`���rʅz �%����ȰB�2�:os���u`��}�?�'X_��ܵ��D�5���!�eswl���;V����[%�[u�r)V�b�a�D�� ��~Z����+ƚG��Ȥ�O/�$��:�T\�\�1?��h�#�*ƹv�u^;�P.^�E�G�'�������4�%�!�Ҡw���g�'^nV�+\��FA�#�O) �B���J��C|��O�
Static task
static1
Behavioral task
behavioral1
Sample
HackMta_By_Dyck_1.exe
Resource
win10v2004-20230703-en
General
-
Target
HackMta_By_Dyck_1.exe
-
Size
5.0MB
-
MD5
6576bc87a549299137143bb1329acdef
-
SHA1
7f367608f1034f637c2ed1328b4430476ef6a3ce
-
SHA256
8742e50c5df58b912c75ff4388da0afbde6e496a4a16cf53c849151804f65c0b
-
SHA512
56d5feb14f66c71f891896ca45e5796307b67f004a1548b5206d0ab9677c481107e8fa2db180c0a12a440869dd0cd9ccb84118f3a21ac81bec0d0b3c2b900e48
-
SSDEEP
98304:k5/csG/DeJoA0SJRFzEIwfTx40JmHj+KgtZV4KwEujEWwAli6lQZOWSuK:kSsGLeb0kjEIQTmetZFwEujEr36lPB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HackMta_By_Dyck_1.exe
Files
-
HackMta_By_Dyck_1.exe.exe windows x86
4b15391cf23aecb234634dd3cc19c6b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ