Behavioral task
behavioral1
Sample
3036-2-0x000000013F3E0000-0x0000000140316000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3036-2-0x000000013F3E0000-0x0000000140316000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
3036-2-0x000000013F3E0000-0x0000000140316000-memory.dmp
-
Size
15.2MB
-
MD5
a981ed83ee4b3974f563fe126df4e272
-
SHA1
5e237e516abd0decb55fd04b15e6003c6e0957ce
-
SHA256
c71a0f1b4e8d7dfcf99e5f121aab15654ddf97622e62e273d69b019c4f8f8a4a
-
SHA512
0832022186632b9bfe966a4baae4e06e5eb1472644946000a3fd9a8dad0854b70c93baa67920b59648dc0ca2e64f76f70271def0f00c99a7165bea0427d6cc7c
-
SSDEEP
196608:2mfnGUfhAlOnm2c913Vx2CLn/+uJREjweAsQfAaxsZMoeE86I0b:2qGUfuKm2cTGK+mCjweroWW0
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3036-2-0x000000013F3E0000-0x0000000140316000-memory.dmp
Files
-
3036-2-0x000000013F3E0000-0x0000000140316000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ