�S,�����Am}����C��$��Qw�n�#)" .yԡ�5Tm#��^ U+�����a��o�!�bӳ�=�j� R�x��zpT��*Ƙp{i�����o1��^��V9�Z��;�_��F͞�q�$6+�!wO�)4�A-9�(9���1ƤZ������3���6nsm���d�-6N7T�U)ĭ�&O]����b�����P�:��\�@�Ϩ�'�,�} �J+V�5R��9���7/��ďikNe���]a�<�RAMOvTs�N��+���q��ۿ�:ӶP�l����0|Ъ@k��{����*�oPV�)m���0�PϷ�8c ���X`ҞI�$�u�p��<��Z$~�$[s+p��o5�cb<�$�w�{0��� �����!|ݙU��*L�!7�m���F��&M�KkзF{g72т.gpđ?bxo|_B6j��ؐ�c;+5�X<PM���̛�;p��qOY ��ҫ�� �`m)l!��)0�1&�\*v���H�R���4+���5�a$�a�[\���W�>>��b�l&=�I�*���*��ۥ$[�K?�OuA�xHfT���;�sxkM N~���pC;;H�����KN��/ t�/���g����@��GI�md�Ŋ8O��2z�����E:���AY][.�/�n�˄0le_;��ՠF�j�X�O:�z�9��~]����:q-���,z��hʥ�p���<�\ >t��i�~�sMXsJ�WQ_�4��8n�"Ż���x��X/����"Ԙ�h��x�|��Ɏa��*K�xb�2ii���'@����c�x5������j��FLhjA�))�ԡn�&|LO醭8�v�4'�8�AI(�bi4^�"}�̲�O:�tS��#���Dx$��g��� o�3���q(�zԜ�x�F��w�$���x.�m|���D-Q����ϗ_-���u�5�7?�� ��xz��������u������QSeЪ�ҋ�r+LnB� fj�aY�"������#�D1%ҳsi��!���<�[����SL� ّ�H9NnPu�mW0 �Q��U�:���=�k��i��,�����7*?B�ؽ�hTB�-�RA�Ff~�a�!���D����G�Q3����:_X���IƆP�J������I��|�������(��<1��^\�_�B�l,���KzrT��g��iV��k��Ř!�l�`�x��1R^ӡv/H�u���Q����ؼ��C}���^Ȝ���y�.�rM���b�(�K�}��w3���Z�����6�D����P=�La��2��m�1�BQ5�AV��4�`TG�w*��U�������������d[��4�4��d�H��.i,魏�c�Nں1��}�в�U���{.s��`��I;��E�P����|��0����t�'��F�)#�p.75pU��t\���[����Oÿ���h��5�`�x]'gt�����u5�'�j�O<h��/�-赶Pꗳ���/o��H��(��|����[�8׳�+Ff���7%۾�,q�/5G��(G�a?a�J�Sf���y�P�]����\�4:b!��Y�>4.�b�$�[�v���/��X����˸4�Q� �\D��.�0��eEҙ�s �m�δ��Z�eE2)@�2���Iunӟ)O��\��,��� ��L@���Ѱ��3���e�YO���h-!`���WŬKƨk2# SiNe�W9�ܚwS�� 羮o��u��2Oxð̈́F�<��4`��WO�y:Ǭ�=o!�J��9LM���Iq� �L�>*F�2C�ݩ��s&&�Tl=�k�:#����`Q�2e�\v�E��^�E[��>�1���@K�5��dD����U����7G��mN: ?p4��s �i*�C7�p���]�`f�R�ܛ�t���d�f T���{ �2���+<��ȭW;�X�;���� ����C�q�C�:�%�К+3������M��U�d�T��\�����b���6˲��8H̲�*E��jD�<��;��dխO"�Á�V���C�������������H����Ѯ�u�dWG�r��ի6�Uk��,lg[0)�B���sx��w8��kg���l��}�Pb66A�X�4 ���މ(��3�a6�������U����1���Y ��Ҋ�J�s����]��Ä�����]�8! �>���#*�9��cx����n @߷�ݴ�=���ѿ��s�F���#㐶�F�� ��{����O�8XT�!�S��AE�5ˤlڿ�������G�h�=�)�k���3�`�pa���eF��:��Թ���}@n ��w� ������fg�x��k��mA4�V}p�J�c���*hnm�!��̠~~�a/��1 �)�1̺�����>��"�6o`�4���[m�%u�xI݃7���e4�S���� ��A� ��T�Mz�0?I-ѵ��{�w�vf�|����e}>�Bl4HHԏe�nqF��� P����lđ�6l6.�)�#�� :��B�@���+K���������ecp�fqW(+� ����L���O�K؈��$Hz{-�V�B2,���X�1��c4�H6��/��?c8av��]�])�8�AXS/=O����1�}wg ��)�+�cP;���� }�+�7���L�`ɺ{f2:��݁IP�8���Y���\����Q֒�r���oV?����"��f��$��r�A�t���t���PP����c`��@����-y<&�)��9����@��vj�� �A� ��J����B���9 s���r��h$Ȳ����~�^MzΩ]�D��fKj��E�4Q�#�pH��){�+P03�l�x�^?��s�>�}���$�&$LCX�5���L^��u���=���~����Jf����m��a�R;�����2�������п�tv�����߶*g L��糀�����.�dG`�a6�H]y~ik���G�(<���>ġ9�D٦��1G<�|wM�:�&˵:]�3m�\��h�%!@(ײ�D"�dE5����L����m�ɍ�[���.H%��O��Q��i�I�� �Gp�����8Z�����0
Static task
static1
Behavioral task
behavioral1
Sample
LOADER.exe
Resource
win10-20231020-en
General
-
Target
LOADER.EXE
-
Size
44.6MB
-
MD5
c9c0d09e522dfdb9b1d805e2c128667a
-
SHA1
3e35092a41e703d44e70ebd02da50fbcf2ff00ca
-
SHA256
148ceeb27ae82e7b30eb7cdeb08b58ed481bcae1a9c29b38988b3ed993625964
-
SHA512
b5486288f179556eed482c0300ef4a66c35f8982878f8563663690accc7a991280d70bf393165943d1a8376fbf2aeb0856d368f2073de1be0862095d6acc470f
-
SSDEEP
786432:1le4z5F2R7nJFOBWw3x5UyS0H+p3qAu1MWmhk+jXofSTX9j00Kl:FfqFCWgdH43qd1MNkYASSD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LOADER.EXE
Files
-
LOADER.EXE.exe windows:6 windows x64
Password: 37546123
eca47f651b45c372360db3225f9d6795
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
d3d9
Direct3DCreate9
ntdll
RtlPcToFileHeader
libcrypto-3-x64
BIO_free
libssl-3-x64
TLS_client_method
ws2_32
connect
kernel32
SetEnvironmentVariableW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
CharUpperBuffW
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
imm32
ImmReleaseContext
wininet
InternetCheckConnectionA
Exports
Exports
Sections
.text Size: - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
."w" Size: - Virtual size: 32.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.H6, Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eDL Size: 44.4MB - Virtual size: 44.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ