#/��J�Fʓ��"f|��z�$�G�2=@y����Ǔ�L�K������J���]͢��:�(�w�s�bK�����f��.�"��?Y�ק�*�:��N��1{y�(��fM�O2BAsi�`�Ьة5RN��<��tC��M����pw8\D=mA�%��k�oQ(3��g�4�O�(�]$M�ڲl�O,�����4�IA������NԽ �b����Sî"Mܙ��w�Ձ�\�i<���ݨB��ŊUXRR�뒗�/�2�IX-�֡Q��9�c��.<���+z��\/u,�Q�tlH���6�^����z}�N����^ b�TӎO�U���zl#l��y$�O7�a����8�������#��2�l���vp=������ݙ����� �e�0����A�s�vQ��G�1�9G:��-��:�!�J��c���+�?�y�*A�i��lc/��tA��� v�'-��aH�Gٮ}#y�H��w.I�� ���L�-p(lN���K�d�}��B��y�y3��翖�'c��h�(u֫�dd�\h�K���u�v�Q�gDa�� -�iߒb��9V��3M,��~��2��x��������'��e|'9�����i��6u���wj�Ak���ARw�~g�Znw�����u����P�����a����r��|��+D'��EA��$Uw3�òGsW>'��`�\���Q�-}I#&���ܳ!�cVG-��_`4�¥�ث���@_J���j�"�VH3AϮ �Q�#=��6�+g*C�����`{�d l]L�c w���I��#����8�jm3l���2�Mm�����O�Y� �c P�v8��w.ʈ�����c�b�G���N�l��B�[ҥ�8/P�_���O�:\�UN���y�ڤ�+3�Q������������瞧�M���f{1p��*�i�ԡ�2��� mP�_%��d�P7�gV����� ����)*T��juA�&�YSԑ7�{�ک�݄�O~0_<�K ��-t�~��ah�#c�)��`D�Ŧ��.[��ˆ�Q����Pѭ.|����&� YM��<���8��m0�1��g(����ƿ" m���h�M �����Օ<�{�����D���g�:�!� ��(&ڄ4-/��ߵ^��Y�C���'5�T��a*���K��b�����Rٷ�\z]�=&�H���� �N�os�iZ/������Hό��6D���8�x��-�KW�g�Kzl0�b���HD�.`��j] ���X�I���H������4�`�����8B�Oѕ~6��w^G�7^}��������V�/�n�k��b�գ�������+�/�w�{�;Ve�uׂ��q�#����"�NF+���/OƮ։�$<����C�.f�}��[fҪ.�L�$>�����ɰ;�nv��۪�L��MC9�����I�#�H ��A��Ή�`0 �"%��q���b�������#��*r=�W��q_����u����]����7l���L.��K��cVaʞ���\TVeA�u<� ̏�Ew8�K:N_+ܘ��e����}��� lZLJ]I��/٪���n�b���n ���{�����������^�3u����3�yyE+�Tm�W��s����}��f�Hǻ�-�'����s�W�%�"�V�tnf��:�(7�rR��s���l���k@�ʳ5�zw�U=z��D�s��m8)�g���$�ɕB^��-R����W!�C���;�hl��`d\Z�K[�Q����&����c;;�Aq�B9�3H��F����B6U( `@��&{d��Y�`�����C�'��O�}�DZ�úq77_T7��!7�F��Ȟ&�O �t�����g9� � ��W<;�k��0��g5|�&���%>��-n�����H ͐@�CI�n{���n@+�Ty{l��f¶E����GI�mI{-����k��dN�Si�q6-����Im�=��U*;J:��p�ԝƀ1�قx�Pl6"�S r�$~S��`�nA�7g �^�����(V̗��Kb ~/9�|�S9h���9[����b�5�G�C���a���6��-$����k6S�J������ ��x�qHlߓ��ˋ�$������7�*(�������w�9A�W�E�Ѯ��R��]�M�F�����4�В��a�=�������%3����i5�d�GN���j1;å������j8���p��� ,Z=5��P���۳D���W:x,�h�M��%6P��N_�y ;4�-������C�����gB��g��� ����X��8&B�=Ǟa[��&�,�Fӧ`����ݣv�;�ƈ_���&���'�z����C�|�H8,�%w���%��hV�.0�QzA��w��CP�R"P��*"7�r. ��M$%�>��So�����W����ذAp�QB�b���R��*���1?Q�Y�Sf!S~��b���o�ν!Xj%x%I��Fhhm�}3��v��! ���vי\&��]�N����W�jt���w ���e�գÏ�X�T��I�V05�<Uv�C��IS��>��w�l�ϱc����oJ�X�L����#��G|� \�<�����ԢL�]��N���ɼ�d�JL=6$���&߿�s/��Gr[���V�˙�S`�ۧ��j\�X>LT�1$����F�K�۲0���\����8��BY��y%�u��e .x1��1�ɮL^Ga8yj؞�A)LE�$�&>r���L�"Է�j�������v�\�G�\�� �:JV���t��|�̜�؞�s�4�(Q.UccW��4@���v`�=����)�rY����~����g�� ?"�z�3Y�X.�c��wq�P��BJ��w�&�hv��P��A������W�T��&��'n� �$��M��ZN���4ό/ʇ���"�EeR؋Gc���#�I��Az���d�I��Kh/g+�r�׳���_�N��o��$�f�P��(Y��VY-h�.$�2b�=l��ݷ2Z�~�D ��<�`d%�d۱�&�_E��@q8E�� �p�X�L7M�
Behavioral task
behavioral1
Sample
Accountsetting.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Accountsetting.exe
Resource
win10v2004-20230831-en
General
-
Target
Accountsetting.exe
-
Size
6.2MB
-
MD5
0606141f3fad15f21ebf58bcd5c49f75
-
SHA1
098454df527c1315e80808328dc464286fa90859
-
SHA256
76f0851190aea6cb9add8591a662322bd88f742d85f62bcf54050fe5b380eed6
-
SHA512
1ddcedc9e695b29dc44a0799263c8c50d6c14adae9e0968a501ae25b387c3f4c1b9aed29380800a3c6cd734da0ac71d5d8151f51172ce133e7caa1ce0541df92
-
SSDEEP
98304:qgMl95DqZYNTvgSeRK0eINIehsEB0ylMlzg4x4hFq1u9roTkXWtHErGy3z6r5MNI:qFX5eGiK0aEKtP1+rGkX2Dry0f
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Accountsetting.exe
Files
-
Accountsetting.exe.exe windows x86
38c6262acdcb4b92d2fd4d2e16a1258f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ