dX��a�:����u�ᕞ�q��Ħ��~����-}����*��) �)t��]�v\ߝ��-�����֮���J7Ё���������'�����r�x��o�;��5}1u�73�g�X#X���5s�)r|��RD,�b��p��A�D�r������#��h����C-��� ����D�'�U�nA�,��^$�K��&����o{��ZR�x�I���)��qFmX��cl�m�͓7� ��GF�1Es (I��3��.d�8�M^�\� !MX�K2���V���)�v����+����� �͖�b*d��T+���Vy��������ǎ#�&�0b�T�a���PPr�R��,Hp!y1h���ydϗ��G���l[`!H7�u������v��ã�=r6^U�u��f���R��4� �[�gF�RPQx�؈Q�x2�0�� �A���GkĹ$�>Zp;�|�N�; w-����IX_�0���J{3���e&���c�X���S��-q�t.12�X�y]h<]�'/f6Z�g"o��x$� 2Q��(�e-9u�/�ro3�>8�X?�)�G������_3Y����Yy<��v|�m��4�ѳi&2�x��� :ȕg��j�ծ��%���6V2��讛�<����4�a��ȹ�B(���E���ڏK��W�ܭ �:�R��(o��y�<����o8~pQFB�.�� ��0z��4��P���˪�j:z�E�d8#̥H�]�;W1�ǭ��m��m���p���iN�tQ�_kM���}�j�,y�Ѳ�# Ȓ@1H�/&������D^��z�Zg��n�� �"�M�1��HW2X��X�HOv��#t���e_v+�>�#��>r�X��9�����)�>�Z��0Y�L#�����@����a��آ��Q}Jʽ��B"�\7��H:m,�����`��"��Y�**�ˡ�E3Jm�J]�@�tF���ۜf�[d�����iI��@ahE��!G�=����@���דּ.�K�@������)�.(�߅���;�".8R����:�9�{t�^m6Uƙ�����A��]�&��WO;w���^�����:R� �҃N���Q�B�β�V�Ӌ!E�=3#�\a��F���������=��}'�n&�Pc ��\��H^U1Ė���i�!����.6��HP�&��Vj"��R.M����9�a��6b�Z�ͻ��)�Bl ���E��&���e.B��n���N�)����Ji�7�&ۣ2�C�J � ��O��� �J����my>1e�����g�}�dLL�(����a R�ćn!�[j���ڢ�j�S#�����1�=_��2�#T�,6NU\�Vh�U3:����q3e�!��VQWwDA)��JߩYZG�s�v���H\ �bzc�<�u�.)��l�i&��4L�@�*���;�g�!UQ)���ʤN7�E�y��+����e�s�r�̲Q4}��=��e��Ә�ѐ�ؚjV똕r�j�N��O�<5��|�q�Q�H/]|_�CF��K휌�IN���x�m�����~¬�n;_物6X�H�?����KL&e�q,ڱ���ж��G"F-o�n&�g��s��E�w��ĕ0;`��긤 $\��l���|� F�(�����GM���iV*�����1�� "�Wd�j�s6/��8�Wy="�N`Շ�7?-��}���j����/4|��M�;�ҴU��s�az�֪��"L�L}e��&6��x��D]ļ�n��k&�� ӱ�l֬�J��oȢ��IxR��@%k|�����D(%8�x �H�6�� YY�_uSw�cV��G��/���Ɋ�`����N���gyq�����n�a|Xz��;-�mIy�B[n�4E �{�\J��ʳM���g&�pw/.n���v;[9̭���ߌ��;�y�|����Z)��Ux�F��u�L�8.���W1ü@)y�t{b*��i�D����Ph�h)���%;�7�okd( �֫<^3���\���Ϫ����J���_a��&?e�U�w��]�N�Ol�D �r���g�:xꕿ�L��ږʪ�ol a��լ���|����t@��������7w���FPjgi>/�>s7\��K<���L�Z�6me6�E��sؖ��F$p$��t��6$��g`�W���Sa��bF2�}Fgqc��M(R���B짜7:��sN{~фUv����%[ZG �WϞԝ��}��T�l����S1�9�6�������7&�!��tG�%��:/��;�F���ՠF��EE�����N�@�F2�5��M���huj3���/�Lb���yE���o��т�g>c�Ϛ���(߬����:��v���:��܋��_�y��"6�v��x_��3y5�r�5<-�K�{�s:夑��ֺZ�v�\W��|����3N���)����[�WIb�������U�0�A;f6F����<P�ȟ���&����ǂĽ�b��� �c]�,�X��8��̧��������R�A�" �; :ؚ�.2�$�S�z��������Bx��,����I@�4�I� ��İ��-0.�=8A��N�\�Bm?��Xթ��kUu�Ι��l&��f�:�ʸ_�WDS�>� ����Q�/Z�����-�-����ac��nz���Z��8�F�IFԬ)� �� ��OT:�"��i��*������9c��?�]��Ґ����3�6aV��{��O$Mњ��,�~�t�����U�fm���#�4x�r�'e�&�s$5�jLwR��8G(�drW��G˙p����%�A�%ٞ��<��Q�D��V�9+ͅ��H��y��=��V�T\��)�+-�ji�J�QG�a����%��U���+F���������;u���Lȋ上;^s���0�"ʄ���<��S�@H<�H�����6Lh&f�v��h�1����[�ŤP�G,$�@�����/����uU�@_=�J �0V��QS�Ԝ���D]���[ȝf${��<���4�e���93�ou��d�r���+�}0k1f������@үXc7�6$gǀ T�A��F��7�W
Behavioral task
behavioral1
Sample
Yams_Services_Free_External.exe
Resource
win10v2004-20230703-en
General
-
Target
Yams_Services_Free_External.exe
-
Size
5.6MB
-
MD5
6d960ee068d95e71e82d3902721099fa
-
SHA1
9760fbf5bbc942926f51d9b85059e3aabe34b4e4
-
SHA256
3f996afad37f479d0fef84c0304dbd4ea3ca72e5ab7b359a055c0bd0bc441aed
-
SHA512
33e29e0ed7beb8e3256b9ac06188bf4f866937ea69f9d084be626695fdfb481b605632c8928a2cfb87f18000f66112fb683a9406e405578866ee8c3a57c72b3f
-
SSDEEP
98304:ZI8MoAaMtOPGwxfKus5bDYtns0/7wX7PjKGzMRXiuyzWwsrpDdfwHrlRhrc:7MoATgGeSD5bQlkXLjV0yhiDu75
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yams_Services_Free_External.exe
Files
-
Yams_Services_Free_External.exe.exe windows x64
569600006c28b47e70051e2e43c6da97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dwmapi
DwmExtendFrameIntoClientArea
kernel32
VerifyVersionInfoA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
imm32
ImmReleaseContext
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
d3d9
Direct3DCreate9Ex
wininet
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-string-l1-1-0
wcscpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ