G�ɶ�r���Z�5X|<ậ �m$�W���Bt�C�-N6�n�Y�����ظ���%��0w1��ؓ��5�s㟪��TY�V�ߎ��ҋ����G��E�Q�n)C� �m��$�nԛ}�=I����(:�F���n���R��������W(���*?m���-�'�U���i�P^@#�f�O�u�U���+��`�k�X��~���+��~4bW ����'���ٕ]ҍ�p���D/��3j��|�z�QȫB�h;~�~��1���LKݪl�C���|O�ړ���-�P��)[�d�WB�Hb�y�U�>hϹӀE��#�!xW}�@ȣ�br������uZ��,�Q�����D���5�_G�k9���<�Cx$=��#X��y>�˴��(W�uet�"��Ի�2_�Cm7?�Ӊ*�:�p����~/�Q^��"�Z ���h�΄� ���j$n��k&}��ŷ�����u�A��-Mj����MĨ������b8_~�������� ��D���x+oa��c�>y��/�x� >��R�L�u��)��<o�6 X�j��30i�.K1�瑐�i�C��B%�7,�V �O��ԏ=�M�� �mvU����� �7@h��kA�xvsK��BO�B���.'d5�<�pK� �0f%U��K �+��B���{!��gc"u����L�t�?��:ʱs���e���2���y�Ln���R�Ʀ`秴R��.E1�5�Ӳ��+ۏ����6.%�2}���v����`���9C��̙72�]��^?�"�Z����y����tKO�34ۚ��P�T/L5�����,9CP�������� �n�kb��EZV3��M��(h/��¢�L���~)%�U����Z�#z�d���7,��c�cc���<� i�¶}هq���_�9#��w���N��=q�tWL�H7���������9��LI��������1�l*�B7O�0�x/8��}Ȩ ��QR��>I�u^Go' (����=���$�V�M�)�#� ��;ry#ӿ��:S��>+�:2�G��0�"/fHa���W�*@��ٸ�ԍپ���y�"Y���mC����"�8X-�&��\k �к5��)v�ME$M�V"��R<�PSLU�z�0�B���+P�e���ir��i <T���~��Ф��B)v~?��Ik���!�`=��:50�5� � �T2������I/Ƣ��c������� N��� ���k1�F�S�%���Or��>W�*O�2RmMU�6�m�{����Z�x�����楞V1-!"0��_�# V��MJ 9��Wj�~S�����B̯�9A`��S�Ճ� � �lVT��a�"9����9��/y�9IP 8l㓌k�|��#��3�3��9{�,I�5��D���˰o��d�י�6�� �Ȫ�IR��;Ce�j��]c��������� ��͊f~AV��yIpʹXO4�s�����4�&�~��r����)��L��7m_I��;��c��$di��~�{m��k��I���*M"f�R�8���"(x��{����� �Y�'�D$�Q`Ș�έt~-9���� ��:~���4�o0s��gU������xI� ?�[B��@c�KBZ,�y<u)߄��d��v�{���s1\�G_{�)�㼊2�����ǝ�b�<}�'��R�v7O� �_����G�M��<(z��Ag�����洁�7�ץ'Y���4� &�~*!�(^x�lQ8��������㹭B��s�'���d�XB ��]-�Y���c��#M��� ��l+�;������Ĕ��|�J�Y�+���J�5�ê+�C�~��U{�ހ���IG1=x�ܔ�?�_�en���5���ݡi�[(,J�3+;�2�yrj)��G�+�6�Y�A�hp��B+��.�06u����t-�J��v@�.�T� �-, ������/���� �aI�\r����&s�X��?Q #3@�D}V8��Ȋ�ߩ�s9���\>}�z%9c�Ie�P(��(�*I����DgC���4i�b��|"�>c�5,���JU2�]��y���u����˄jҮp�B��_b�}!GD^~��4��fTv���ϜTҖ>�Y��~�7��x,Xү�i�kE���=��C�ˀ���Ф��)�b����nӔB_q�?�3�"e�*����bNB�����<u,��.y�E��I3o^3J�-��Ո�8��N�S���}��Z�P���PT=���5�HBB�.�)|�G��r]�ꌿB�-�£' �@����̷��k��I�|�@&&*��y�E�4����gx^&ڨ��!2�l 0�W��f�?ct��!(a�S%�o�^�:ᎍm����`�`�x%^Q3�|m�`8�g�Gㆬ�q� �u�|�J=�PW�p��u)�`UW� ?K���N�ya��*�p?���$�e|��=��@uDL~Q�x��~��&���mc��mxj��R$_w�i�R�D�DBb&��A���}=}n(4�W�0|�ܬ��^�\��Z`</�V2F�.I"+ce�"�lu���!��\�O�Ig��y� @�,������4��� �)��^,N�?��X���Poj�w��$�i������a�cUn�b3�XaU*�c����b�tp�zz��s�N�w#�� �B���M5��S�\�7Є�>��I��bև��P�b��+3���%hͣ�ۏ����+A����z��PPe��>�~�\@�����ʩB����(�����Wvz;���5��z'�e��\��;�V��|� ��ee�1�w�en��{��[�eAC�����e��#�Q�h�����s��C�z�i�mg�y�pϘ�V|N=r%z��n0���Q,7���������� �7c����m���G� � �GT�v`Ǚk��R����+��1 _�7(����Cui��Pҁ5�p��ƯԎ��}�hA��puO�ЃK��$e-��x����Tc�0@1��IQn��9���y��Y�g�Q��4�uO
Behavioral task
behavioral1
Sample
windowsProcess.exe
Resource
win10v2004-20230703-en
General
-
Target
windowsProcess.exe
-
Size
12.4MB
-
MD5
97acba1c1518c7289d5cdc4d033ad4ef
-
SHA1
f8356274fd205905b55ede41a46de635fcb6e102
-
SHA256
32bbbf82d9a2e4bcae3723561843c5f5268ca1585d7939c441b20c5712038db9
-
SHA512
7affff7761061660f98d71c52c27b00d14766551a8273b20d3d6f9b50e04237bb68f69ed50cd1365e0cd02699838da63ebc50e5cd95e80c310ef43e7a8c2ba90
-
SSDEEP
196608:08MSPJAbjVvz+KFnq/8ea86RT7lBHQ+tItAJSXPK6gE/KDI7Mu9i3tofrzsnii+V:HDPJMjV3qi86RTXqx/vLBMuZr++
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource windowsProcess.exe
Files
-
windowsProcess.exe.exe windows x64
eefd665f21d9d66af956385016f730ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
CreateFileA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
comdlg32
GetOpenFileNameA
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
imm32
ImmGetContext
d3dcompiler_43
D3DCompile
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertAddCertificateContextToStore
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ