��]c��%�X��? �?I��m�!�@�cv�8ƛ�q��f�����)wA�4��� �)6�Կ5��fM�őE3m<�Ie��,X���0\rU��U?�L|Y�c3�Iɮ��ʅ���̼����<Ҏ�߄Y�Ă=�/���A���_&�uwIؿ�����,��H���l_;��2�U[7H]�#چ�5l�+N����U�)��Q-ro�H�NS���|풑7�e��e�ajbK�OEHY ��(��88������cz�D糢:��c8[� �����ӱ{+>n�p�7��_���㦭�x�6tIp2���gg��1]Oi]��!GJ��a?b]��VI��t���fW/�0�<l9�W�ò��X\��|����ƚ����ٴ����W�H0#{"����rn�\,�wh�¾ØΈ[���鶗g��c��]s0�� ��/�4_b�2���Q��J��/�� �j��չs�����V��6�m��r�n�����;1,� >E�e����ޱ�4l��;�b�G��Tx)���"��x3�F�~εV0��,ƕIЗ6v�[�F�p:�����Fg��wLos�G�ܙL�um ^ Tc���']3���繀kp�n�/��.���)�u�0�euu��fp��$�f���J'͝� �(�ON��q����y#ǵц;Ù2!��M�A:�m�0֢ÏQ�}�h�ݞ�;���WE���!�a��P��<���W$\���3E5ҵNc�D�B�f�����G�B�%Wjg��c��;����[ґDT��˥�]�YJo��fU�?J%�� H�Ϊ���k��n��G@T�Tg��7��6���5�D��x�ԧ%���g�/��Ue�H]����5��� ������ �J٫}�H��$'�Ӈ�HN�w�k+��%�:���!��Csc��4����`��)X$B�]�Q�cΔNڛZ'�L�)v*��3�� ��fA�hŨY������m��w�z�%�U� �W���P�NVz$�\�c�9�������>�������g��� �n�T�i��f&�'�_��G�Ѥ���8���㲄�n��%f���7��Yd���͝Y7��cR���0��b-�-�Ԧ��������B2��ˎK�5B�5���+j�Ր�����#*g�5��lլ�CU"B旦�u1=���5���p��T�4�VҠS����^�d�Y�5������FZf�Wv�&�6�i��PM><�j/�����`���8��%_���du����)�$ ۴ΨHSK�N����i3q�b�̺�����@��l��ԛs(�gU!�b��T���gx/8�� ��!���t� ���P�,��ތؗ����9=��O�ׯj�ͅuy7����H���4@��4��>,y���E��H {$�o����B?f(n�;���ô�n�@6*sd �VF�NGʐak=�+gw��o[�/F��(��>�} k3�O$I[�z�/>��+�^jJ:'k}-s��kiU�66;��uF��~��U�y�R��������arV�_&t��n�Tp�@L�R�V�~h!=p���X|.����� ������w.��H"�sE�� �3���K_�T3�rj8Ze�a�AV��Ĥ\�o#�b����=�./�N�������p�/nѴɱ_�$����("ĺ{H\),�*��IJ��2�N��^L8N�No.�J9�L�Wp ��a������Ҧ��G���jJ�LQ��%^f]�c��}�� @U���LM���{,�]��qWQ�PQo�+�w��Q�I�d-��z��?#Ep7�����p�D�2Oλ�A�� R���{D��-(��A�Z��d�nۜ �/�c�D�C��"���H���o�����E��X�-���aDK�o�%}7�*b_ ;�����:��� ����u�������:��㕔�}\�ߔUj~z�jʽ_��,���4�7�uE�(�+���k��}�R��v���$8&!��r J����Xm�Gz�s,�ˆ�E8�Ef4k<x��2dм`?� >"�B�0�ǫ�?��skRFo����M�ws�2���8��+L��K��b�3���u�~k��\�w)�%�2����j��HZ ��+�˫��}0�H�����U(%6f�WDpZB9y�Sr�c�g,#��Ʋ~�?����!�t�~��ce�1������=AӉ��|�W�w�z����r>���Y��Nb|��(����w���y�N-�St�5Z8�����^O�+�-Lof:� r�S���m��D���35�\ ��l��|�.R�< XԼ��Yq���҃._�^7U�~V�l�=k2m^@Vtׅ������ W��j�x��ZX昼K穽7��k^h�3�`t6����Y|R��0Ʉ��#�3mL-�\���;�;��FϚ��S�v�I�c�8a��@��K��&R��h��gy�!d{y��� ���/�F�d����J������0~X�],���HP�̧�g�� ����L_�HP'-p4��'$,Vg'��dg|�A��q� K�^��ԝ��t�z�_{�|�\�I���̈?��� &y���D^�!�J�S&�>��@���xȷ�z#�N�_���S�37P��Le�u����7ql����?�ޡME����>��jBh���b����2��({+�o����ۼ嬆X�t�<��Z�nI��u ��^ ��������s��HB¡1���"�3�9hѷ���]V����|uo��G=z���V��#L���כå�ǸkU�Zac��dɁ��_���)ݕLe�X������_R�Rag���e�m�|�/�k�q�]9�%�*�}�T�r��ی�'_��'����(昖�h}���s�����'������.D�9��֩�| ����4�cC��'��b��0s\~����Pim���pA`�ޮ�������g�vd���"��������b������̻����^gV��|"��-�CE�u�ŕjgvA�1�R��&Xe�M�G��[��uz[��K&�� �f�Qӻ$g�h
Behavioral task
behavioral1
Sample
NEAS.7a6b1d114bb35be6dde30c66127ebff0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.7a6b1d114bb35be6dde30c66127ebff0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.7a6b1d114bb35be6dde30c66127ebff0.exe
-
Size
356KB
-
MD5
7a6b1d114bb35be6dde30c66127ebff0
-
SHA1
11b3a125532cb9d115fda8c16c6901d4868ff189
-
SHA256
d34470377d15a8347f9716e64d952e527327fea9305574882cdacd90ea4796dd
-
SHA512
f6bd9b32842189b268d99ce332f2bda496b59c4f3234c883e0c8c30b7359b30fee1eb0644158ebcd781e08d33f09460fee559d236e99a2374d5caf98db866226
-
SSDEEP
6144:/MkHNOILPx53cBxJ/8XNxPPMswYF1kwn3IsduPV9xe6K:THNvJ53AjEXXMsNF1kwn3YV9xe5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.7a6b1d114bb35be6dde30c66127ebff0.exe
Files
-
NEAS.7a6b1d114bb35be6dde30c66127ebff0.exe.exe windows:4 windows x86
b0a6dde851364e3751c2e00c3bb98a0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
RemoveDirectoryA
CreateThread
GetFullPathNameA
GetProcAddress
LockResource
DeleteFileA
CopyFileA
CreateDirectoryA
CreateMutexA
OpenProcess
TerminateProcess
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateProcessA
SetLastError
GetModuleFileNameA
lstrcpyA
lstrcatA
WriteFile
WinExec
ExitProcess
FormatMessageW
LocalFree
GetProcessHeap
HeapAlloc
HeapReAlloc
Sleep
GetLastError
CreateFileA
LoadLibraryA
CloseHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
SetUnhandledExceptionFilter
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
PostMessageA
GetWindowTextA
FindWindowExA
MessageBoxA
advapi32
RegQueryValueExA
RegFlushKey
ControlService
DeleteService
CreateServiceA
RegCreateKeyA
LookupAccountNameA
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegOpenKeyA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
netapi32
NetShareAdd
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
iphlpapi
GetTcpTable
ws2_32
htons
htonl
gethostname
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
ntohl
setupapi
SetupOpenInfFileW
SetupCloseInfFile
SetupCopyOEMInfW
SetupGetStringFieldW
SetupFindFirstLineW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 340KB - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ