����P� Π�W$����{����u�t�Ī������qs�-,9��.�v�}�.7~,a�\��Vk���l��l�KX��iǻ���ưž���a��*��a?2��h�R/�swd&�|�%;����9w���9u���"Lr��Žr0����R��a����e���4u��`��&,ݵ�>��xx%<�)/`�y-~Vv�L*���=�e=�v���t �=5X���q�İc�}/쪌���`J#w:f����s}8W�㭆�%U)S1ڽ>5�*�*���%��*������N���*9b&����S]�R�N1M��2�<������J���ɾ��M��3I���H ރvk�<�㗡Ǖ?�M�7�r�Ά�. e�^��������x�����[,�H�V|��eO��w�0�w� C*�`VH���+Ha�:��E�2J�)�`Fˏ��L5+��Ƃ��Ø��/��qT�fd ���U���U^ l-3{����~aÏưm��o�C�N�u��������O6C����w��-�5�E?l��M@��NLu�O:6����ae�$�7���_ggJ�3��]BJ\�SI�نfh�Z8�:˴��5��P�O��1+;���1���[e<�}�?l����V�$\j��g���'r�_K��\���h�eWd�&+N��n��l���1��]��(��֖�0��C_���H�����0�v��8(�������R ���c��H��xfs���m���,�gM�x�Px�u@���3�i-@@��(A%�'�[��>��2B�%_�IrAb�[[J�h��m�C?+\�ҵb$i���$aUcN��^���4B�h7������ ��9�Z��K�nKX�����c)E�49��}��g��(�'���H(�����]�.pM˽gal ��3Z�w=dG�H ��[�57�8CMIzU���C)�������"�S�������!n��:]'T�D�}�s������iǩ���H�'�n��bq(�7ZF����-j��Uw�/A|�1ڏ�l_��<�CzɗT��� �'�h������Lt.Eu�ASY�U|>�K�M���⥶��^���S�u`�܂��` ��ŎVF�sL��Ə�Y�O�vnbɈ<��!���3��P�WW��{��g����{�]�Sx=�L���r��=��l�Fy�!�V��|[��z�+T����iZZC���"E�uBHP�BH��$(-�U�(��85@V��W�#���f~q ̓�aGBٚ6%��La�w�G�P�\j�W,g4�M��@�x~h�Μ�=L%��Jԩy��Y �W{�{ �[�gޫ�M�0�RP$��o��CO8 �2�J9�E�ݘ.��@�'FKc?V��,��/<0���#���V�Dn�ߣd#�p�0� �P�䓵s.Y��Qj��.(�N6��D�8-n���m�j�'Xntv�� m.�3�5_�Pӑ���N2��/7��V�mF��u�ќ�$?EN�1����V ��F�h�`�M����V9�y�&*�g�U�2�㨷w����ۄE�� ���`�4��P�%h�`V���K���_5��)�b�n[���� ���1�W�+���L� )�ͦQ��X@`�y�l�f�aq�3d?���?��Λ��;B��e����:�02��Q{�@�a�0d��6��?k ��cUj'�$�ooG��5��&E��Gw��6倗,i��*SSc�65��a.䈭�R/_���G���)��� UK#���bK����U18p�i� '�ImC���J"�˲2)����V��=��"�+��) �r�;�TNf؛n\c&K]��\��1�����Ӏ�D����� iu0{�u�3���n(=0�D��BU檯<�h���ױ�J&�Ǻ����oX0�zy��*���ٛN�md8|s跺œ ;��*ꂄf}�9��:����8. ���.�����9�m�k�mM~������H�1$���b[ �L�9�x�=�0P\���tc��(���X��C��ΐ�2�G���g�&yCgM�q����t+7�b�[o�R{^,�3A4���:�r�@1=����-P,_8Y*,WO P-��Bqc������q����+����"f�v�w��N�憑�*��L55����.�����Y�R�1�_T{��snK~�}+G���ů��F��ҡs8������$�P~��V�+8��T4w>B�I� 7��rJ��56&⏀/�1 X�?0- B �����=��>V@�:�ZXH�˕H�@Oc�|K�uR��q\���݄�fm�9�}���� & 3c�oι.#�J��]=���<�S�}���;:�ܭ}�^���zqRC��zNb_6��n�x��ǂF��&T�-u�ǿ�1�����5��}_��'�����%��Ȓ/{,!!���+�e��-�0=�r��0���鈇�ވ��q���x��Ԣg�?�����7ޔ��h��,v�m�\��c�O�c��ԛI��JE�Ǿ�?e�"K4��>jd����ސ+�u�%��J*:�7o/�n/��K/H�<�ʠR@�����=@��봸$ �SX���=a��%��;�~?����Qd���{1O�on�s� �;�X1Cg�pkL���`;qː� �|�������-����Pv����a��~�+XB�����_Jẅ�61E����K �����������w���>{H���"<�����Lx� S����f�x�]�'B�� d�N�2��a�#�3�7��%#:fT����?� wAĩ(�D ,e��.���W�.m���"�ջn�m4/F����<'�����K��{:{�e4�OPK� � W�T��N��\c�*�~$��!ʼnF��&W�Ti?��e�X�@�u�u|x��q���c��'��NX\yo����h㨟]���� �>���y��!2:Fz9����-ʙ��K<'_��ieH=��tγ�����?�7�G�=p5.�r1.����|�|�v�B7ܹ۞� ��;W�6r�H�w'G��+x�Vf�A�G�������$�0�Z��cB�5 ��������B�/��B
Behavioral task
behavioral1
Sample
YamsServices.exe
Resource
win7-20230712-en
General
-
Target
YamsServices.exe
-
Size
5.7MB
-
MD5
fad5df1c50224a770a5e521e981226dd
-
SHA1
7d3c3ac1be671310f84b2d38f4432181087d6d9c
-
SHA256
57116531a8e52d31804e36352811f79c4c25ace28e5070cc24191fbfc75d9788
-
SHA512
7119a99ffa31ad0c9df68b8bd8d520b395226192a871bd60ae06c5426bbfef38d89add540b56c8ecf98ca523d2cbdfd597823dac8bcc16f9a419ced61b0974a5
-
SSDEEP
98304:g4Ms0gfwdfy9eeU3svTCa0urW9TnDuIOg92YGiNDclktzqZjbbmIQ6lNH:ks0g4fy9RGYyuriDd92ecCn6lNH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource YamsServices.exe
Files
-
YamsServices.exe.exe windows x64
23e05837d2027abf05f2c92f854b3d0e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
??Bid@locale@std@@QEAA_KXZ
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertGetCertificateChain
ws2_32
getsockopt
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 484KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ