y��ӯ���!"���Ė�G�_Tq�����Hdԏ䓋0)쀡���cX��O�u��{m}B��k�6�=#�*�W8GN���أ���c"��-�p��k�Ȏ��`1�u#��ܵi�dp���b� ��ۮ�\t����j��7v���ع����4�&(�;�qȷ�����7��i`�6p^�|7���b1Pg_͉�I<:_k�-�V�Rn����� �v�����r)NL�z`&Έ�-�x+�Ȃ�P{e���o��t����z���ݑ`���'V��)0hnEg�K�ee�J5 LT��^�ly̕�6Im�ۚt6��J�ė�,�/����=U����LBHh�[���9�"�Wy�E�I��Wq� �QG�|2��gZ�c,c�2�4"���w���q@�0�}1 ��d]��T����$3c҂��M!{OŀޔH =�ˈ��a�����B�h��67̆Tu���.%�2��ƿ)��\_f��uH)^���^b���0.�g��C���������KO�f�C��6"����g�7]HE�/������wo�b��Zt%g���1|�� ?㮺�^(����>F{��G������3�&�D�e��v��|� WNt��=Q���u��c�6��(�O �{���#��f��J�K]ga[��ُ�d��� �q�c��/�����11%L����o��;����ׯ��OP�� �>���Ĉ�d�(��Y�58'N��?��;ߤ��p6�t�KF���l��b2C���g�T��(f�p]�.{�a����Z[����`,�v(����1��} -��wxkA�����&B(�-s�qŰ������@zR�\_��=��k��:�k %���H�����L�xmfP7<���49����8���Y:Se@�]K���Io������n˪I&�v��jrtc �$� ����X={j�]��<3�93� �u�'�x���'o�bJ2�`��a�-�O ���ڌ����!_�+�{��v!%M�V������ts�ٮ�9R�v%�*��/�+�ܑR��q�e{4x�"-���q�Q���@ܻS�a*O����ϣX��Z��D����l�1OdI���O�.Đ�k�|��Q��xf���-�ܦF�A�Вgw�ǘf!��+��V����`�^�^�V��>:R�w���4�|m�����or����,����6��M��#l�=��V��^�Z���� �:U�i�/�}��]�7�uYZȃ���� ���t�*�����d����*���)�R�A/j*J�R~ꄶ��sA�֕ۙ<��na�|�M�h��ˮ�_V6!~�/�6�'�Q�Y2���_W6W8>�&������f���d CUu���'������Ly�ʓ(������Q�~��T����!��h�v����*K�Ud ��xf��N�JP<�.7.o\�Bm �s��*�nȠyY�w� �W :������V��\`��"0�Y�������6��b�`����0)>���'�����$(�_�f��J��% C��"x�XxxGY'��0i���c���\�zl��Rl���Q芐��-��mC%K��g2u磮�{q���˺.@���������|���r��ԛ����c&�Z��:���2:����FH'#�_Jnrtn�p6c������Z���Z�d��ic��C��.���g��0�l�N�?\m�z$�]���V�U)��b��`�ci���\�2��W+܋�\�P�\Q�������y3�9��"�3�S����矂t�Q�a=Ŕ��0��PF�*�#�>�N�~*Y�u��3���M*�P��� h Y���.�O����+>lz�`R��qN�~��]1P��Thcb�{�x��?(���f��j��+���3hK��í��q��?�}Q���A�)%�W'�8$���jΉ�AGv��2q��+���ҷ�s����-�b�g�7;�Uҵ=�����"�G� `������dʒ��d������=PA��dlx�hs`�;����Uy��Xw�OT*{�L0�j|�Б�WX(�!��F#��)�߉�w9���7��m4��΅] "�L�*�w=���� 3���pΊ�4���~T���R�տ�oe|�%����!�GY� �"������d�j]�� ��o�Ⰲ#�T�Pl�I~�&?o��{)\S�'nŀ�c�ڔ�Y3��)6��u2r������w�J�E+c'eޢ �?ZV�L����gtz��ʟ�_Nrv�F��|��.|Bf��5�;IcBr2!? GX�c��Y������ޗ�rwm�i�$�g��0��}]ɇ������]�|"Ά�3\�O19A�p�6��y�c>.�j�*�m�#�"s� ���J�Zg�j��)z��g�#� �<�T��=���R+!jb���no�H{�Gt�1ό,2�,���u����̞W"&��E�v߶���1�Ύ��C�!��%�q���?,�i�1�b���[:>C��ğ�L��{�ڣ���ɘ1x����(ަ#��_�U!��"�����೮��Up,�N��3�O��Gi��^�)[%����%���!ct��]�$�b��6��8�����W��D̈���w������lSN�"�w����n�m$��F����߹(��\(e������_���A�)�ʇ�$Z��Y��I��m�l���A`PG�lF��~9�r����o��Ȱ�7�i^�3��|�����y�3�h]��В�e���|N��|2Q�3��4�~J�� ��W^vU�~�K�����J�[�� $/�`�g�e;\d�~DV**=�: � �)�7�Y���N�oF��������>�W�pN��~�P���4Y��d0���Sϸ�p��]�v��D+Ʉ`��0�%a�/}N�ξ��z�n�gr�!FȞ�1�v�����r�YM!M���Gf���@�e�_H�֒#$♢1��PI�'�Ț�F��=���+��#�b��$A5[w��14t�|��8� v9(Q�q��tV������c��u�l���5���}�`�.�OtfJ�i���#��q;��6g���}Zi���O��;��(
Static task
static1
Behavioral task
behavioral1
Sample
pozemenutroll.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
pozemenutroll.exe
Resource
win10v2004-20230915-en
General
-
Target
pozemenutroll.exe
-
Size
14.8MB
-
MD5
86d5019d46253f5efacaf182e41fbd26
-
SHA1
f62eef1bbc213651c8cd6e93faf07dcbbe80198a
-
SHA256
e2b945c729a639d8d2e5924e98a65a6792e2bac3b17813c9f9e845e34f84b4b9
-
SHA512
3b2cfbc58d9b754d02b89df1784c7e7403d28d9bccb97776c86149f9b4c616792d5a674a0c1e79b23986b417b44ead092af75920beede4073fe3f0bd3c0b655f
-
SSDEEP
196608:4BLhL4YrNZv+dV+VcjfFvQU0gGunkLAMECCLi7mi3Pc/dV2K35cBwkagMgn+ryP5:4BNQ+QhcdXLg7qjE2K35AwkagMdy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pozemenutroll.exe
Files
-
pozemenutroll.exe.exe windows:6 windows x64
2c7e8cfe9eb247b417652b28f6159d32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
Exports
Exports
Sections
.text Size: - Virtual size: 422KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.PXE Size: - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SJe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.a3u Size: 14.8MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ