f������NoE�6rɡ����u��eά���T%���ݥⰠ�d��lCX���n���n�+����#������y�Ͳo� ��jvG��Ӵ��@�X���3��eM��� iz������%I���_��K�tee� �$6ݬ��o���'��Q�4��s���T�:�`��x5���Fλ�r��{h��py�c����Gٓ�-�!E�8n ���lo��J�lR�JX����jn�qL���9�\�,�%��*�����yl��K��Mt�dۛ�6.�7��e�|�,\VJ �{��=x1�X�P�#ZX ͗`y��2zr����(�?umޮ���^��HM�� #��r]a?|�ZY�<��/2�$��M�J��:�<%@u�����3�����ɮZb ڒ���$��aJ@�` ���[�h]&�s%?e��8���[:%���7T�q��藘Um�M����"rM*����E�%eʍ�,E�w��-{x7���R�f#&����"� t�jZ+�@�|��r\�.K�!Z�(�B&��9�P�f�Q�(şA�2��)����.���7o��t������%g(�%�ٵ*�O�X���PR�DG����a�:w��]E=��[b(�yeLE�'�z����|��6cI�i_����"X �$tc"���Oۄ �JY�}��5+�P�ٿ��1���� Ì����$:D�4x F[�m�M~�mN��tG���:5�YE[������_%��t�ԭ$��@�����U�D��7&�mH��K0c���.���}]8eb䥲^ߕ�/+^Iwq8/��l�����®����Ղk+^�8��j��@�ɴ,eR�|K�FE�?,.��Km�nU�. �U��;�j�`���W�L�,�f����x���x� Cr���G�����z ��9��i?D��|�>&�y�^zN�4�n�>}֝Ȧ�8���W�""R��[G��O��b�qOj��o�9 ��6���W�;���X�K��(+U���5�Q}�s��_��Xg��푫�"3�ޝ����������j�'�|�!�٦�+B�6��Z>�<��yG!g*�����d0�/��BE��p�0��W�ЏƋ'b��ѸnjQ9p�0>C���Yt�h&X�XY^~�0�_)B1Y� �:�FۺeT�&� G����r�I��e���Ų0-M|���@AK�h�y=��K���<~"b���]D(ǒ���'�EӪ��z��^�zK�v��ǣi��6ݒ��3!R��O�.� /�� �P�"��$�u6���3���ue��|��y@���xZ� �x��_|M��'Pi��DJ2ow�&��� WZ)]l���/��X���Ήמm�H$������hP!�^���z�0�\������W��j���I�-�N�t�P:��������u`q5�-�����~cDKf@�ph�M��2�إª+�-��=[_�Z��F!����������NJ�En������^�7�a�y� 1�I[p 8b�]�����v�M�D2S�nV*I�g����ݖ�f����Aʼn�����eO�͔�_�� 弹%0��۪%��W`����p�w����IJ�o}�L��x{)Ts>7 ��������_�-�*S����㲕�I��j��4r�6V4��2�oՁ�Ɉ_B����/�Kx��Ȟ�T+0_�w����E�����:�c��I�Rc�&as���V+�˿��-��Pe`��{��2�A���M�07�~[֭�la�OJ�9�`?sSB�Q����h�o��55����2�_�CxO�i�����%��Ve�E8���a����6kb.�v��X+̢~�L8A��� ��:�|�+����&�MW�߾�P����d#����H�J���[rx���!�Km���N�S�t�qB��K;Ɯ��PX����~�c,��/O{���J�� jh�Z����?��6R w@�FM$���:Y���{U3O��^���b���(I��($(�S��_�ifW�JX~,�B!1��X�q���hu���K��jF�G�O z�m]�(3����jZ��Q��?��#v��B��J�C.�ړ��Q.'�p�SգslH��9(�yV��Y���oRhUjf�h�S���0HPy��F�`�䈔~�=� �I]�-1�������jt� �N���Z�#y�U$��aD���<.��:x)ބ�$h��ݸ��$��|�V���injɐ��;��[6�i���"y��t,��s94n�����@��%C��cN0���k&��[G:b�83�m�U�u2_�O�%Cb����ƲS�SgB g�dϓ����܀Z��-{�N�'c�C�܂�����1mb9�X�m����A���g'��-D��֊�SE5$��K�Z�q��|����T��W�j���l�]Z?�f��ݤW,���Y���4�[���u�B�o�:\����L�dB#�ds1��"�)���4�na"y�o�H5-b��'������K����kA]����������S�j�获F�p=�Q�c��+���y��P��H���]�[�T(&K��p���lգ�\�.UnAxj��ﰉ�Fr�ok T7]�O5��OŔ���c�5��-F錭dM�|<88.0k��厊a-(���;v���*ͥ���)RJ�&�؍�!i�KL�%�3��2k�u�Ռ��e�S�xB}�[k0��ΦCX���)Fux���r���Ea����,��^8���N�A��2�YS>����Gx���$��%7�f�;�mh֍:(��|$�?��<�G�Q��f)S�RV�?ƃF�6�)x�F��O�5�C.&��c?��3SjWqj8���L�.���jЬv*���#�>"�������۠��h��N���R?��q��C�Gmu������'�� �4R&��3ڵ38�D �̰j+G��4S�������-/Z��}h�ߥ�5�_��(W��ř����:��!U< �}Q�"ǝê�u~�q����2Pڣ Z��{�}a[�@��e�Ѡ�0�M�+�*���v�5��*�s�,����Cm�(\*�
Behavioral task
behavioral1
Sample
WriteLine.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
WriteLine.exe
Resource
win10v2004-20230703-en
General
-
Target
WriteLine.exe
-
Size
8.8MB
-
MD5
31147ffd604d6b735be171d82db3d89b
-
SHA1
dd25e2cd8659a50d6e74368090ca9eca09f9812c
-
SHA256
a428e110efa02f09a6931fe727a714fb15185a47895fdf66f3342b1890871e1a
-
SHA512
4b8f05fb8d572d880af44f04cba35b89359a05157b19e0c502a360ba0c97ac3e2b86f999b02773f347870cfb871606b7ecc91f8e8375e6660cbbe143485292e8
-
SSDEEP
196608:La0K1XZyAz/yM2e2Hl4sd/rlaPYhgnFJfhuFWdVHhUfNVOweP39:LK7yAOblHLdrgPYynPwa6zev9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WriteLine.exe
Files
-
WriteLine.exe.exe windows x64
2db114ba7520955da11b25daf2a2c610
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CryptDestroyKey
shell32
ShellExecuteW
ws2_32
WSACleanup
crypt32
CertEnumCertificatesInStore
wldap32
ord30
normaliz
IdnToAscii
secureenginesdk64
ord104
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ