d�@b0��' �.��'���Բ�>f�����͍$2Į/�o��{Bs�;Y���2��ڏ�8�� s�:���C��0aIS.�tP:e��ϊ�ʔ���S}�R�o���H_!��� 0!Qٶ�f^Q0o*�I>b�N�o(�a_�i�ƇS�>1�?��ݬ��E6\p�+ȅ�@M�v�-�� ���$4(�:�����G���ϝ,�Ŕ �pr˒� ���`�Gj���Y�_\��Gq�5x�N��SB�W�C�����/'sN�wD�H�Js��2�+>�0�Y��UP�4auX�j��@����r���C�+��쇨�Ʊ�%�x!zR�_���~m+]ί=#�����ōļM���x4R���������Y��W 8�t��)��{��/}\�K���Th����Cpr� �O3�j����,�����+w4.搜�����suԇ�]WO�K�>'*��b��9�� 0�V��������;�8u��^*I#},���y�c7z#^,�U�Y�>��4)�-� ��k�\ ڿ����ug�+錙��/�FsA=�#�8�{������������_W�}���\�G�� �|��W�͜j��7pB�&�H�A��n�\�)��/�R;W�����+4A�l5�C҈!�av�g�d �?������T.#��+N��"O��KN�����P$ ۣ�(�"yޠy�nӾ��G�E �&�?��!o'��;+�$�)���3K��H��O�z�4<E(�JJڄK?ۃ6�Ģ��*n����:o�����;S�\�# ��$ЌY1�-o��~�$aֆ�ѷ�%�[��4`�M.��&-X ���fu'w���`��>|<3�K�Ѿ�&�������;(#�� ͒��{�$ٙ]����IJ���R��U��i�FZ��K�g;I ���$�+@���n�oH�X���5�Ie.I��������)��s�"z� Y��qS/�!5��H�j���m���>�s�1��!�y^j�6�{�'R���%��^�����}�Jum�c~3^7��Y�:l���Fy5���V j�/�'��A�uqy|���[���v��-wnҰm-���:�n�~D��v���0e5����X��c뷆;~q5�WL��k���C^umݚ��L� pX6�a��ZCVx��o�WA�rf�_QC���̈́�H��I<OJl�:`��~Y���Ĉ{�C�jQ����>4yzzZ�@�&��44�����1�kf3?Iպ;�����aK��@mo�W� ,/������ �X��ao�F3M7Ǯ���4[C�;Łf�������ѩv�?��l�%�"_R!��r���JJ#,�\*�0 �P�xbC�>A��=���B��(_"�+��4���l�z:� ���j����ʨk>]��ӡ�����3S2i�N��0@�5̉�R� F����Q���y�`f�B�<*NBx����3f���A����C���ff�X<�~W�.��`sL7���tE9rgr�]� �`�~�/*c�����|��f�9o[y�����ʆ ��IL��1 ���a�o��iV��'��|Vk8W�m�r!24 �c^_"��÷��]x���@�=Ub����B�{m�E>ϣ^8��xL��rwMݬ������9�=?�,�<���[3P�V���bO)�j���Q�=� 6��{����J�lj\6�vb�틽��ACs�h��#pk*�M�o�q0��23��py/b_i��T/O��ߝW��S�q�vl�s1�F��ݽ�EM.�| �M�|e�I�f�;��f��;ٗ�ђ j,vN=x�Q �g��:r�:I�̲R ������4M��}9ˬ�ӎ`c����#z�H8���ł�@ �g��:P���_�3=$��4Q�Gqq�g�����hnN*���Td,���ڿNX"�u�NS#l/�̼���2s�[͍L���w�,G���kC����/{� ����)xaC�v�!(����irq����'!����y�*&���`���n���R����̸iyK9���E���81�ez[K���߅|�eC1���9a�Ym5 a���<�eB��#H"����/Ko��M�O>w�h�Ic���sd`�Krjj�_m��(������ڒ�����*"�[t�&�iV�T{�)sY;���ݺ�]$����U#h����Y�x�J�r��vr����e7�%��!�b@�\�iD1����r�C��i;������Y�~I�2K�~0�`��<�X V��#��f��Q�Tg�g9+O�S�a,h�����С c�^2+����h}[���s�~�S`��redT��D������f��){Q�ɭD����3�a�'us�.D�)w�x�E�c����y�� z� ��$��@ӡ��]w�@zH�a��`��00.��A�tR��!�F;��������R�_r�4�(���P��=����y_s��BL\�G>Tނ͐�ʟX̻O�!pgЋ���n�[9d�����]��=�Q��T��خZ��?A���BNî����3�b�����3{KOP<��Z�1JsQ������7����O����<α)ef셀�`���\$� 5)��� ���Kk�����.!D�� ����(��1K�YgxL����w*[@��oyk� �."v����+�{��&}E(&mQ���_��;'�]��d�6;Ri���[�_������xiF '�|��X`F��>�� N��˿�;��U9v>��ro�J��� Yi%D:���ן���H�DݽI��� ҍ͒Q����T����Խ���O�=��n��Ȳ�&k����c�˹�������1��/_�N�Uvu��Nj��U�N]�U��r5z߬=�A�BI��� �~z��8�Zb=�(��ވM�+��3�Z�sx�*~�l����v������^�lx�?��f����7��i#b� �(g�� cc%�⥡��!\8"����b��fA=�Xe���w�5;�R�/*k93Bۙ�D��.���ѮX��6l�D̔SCM�S�w!�`�@��� ݗ�+@l�_jezm���D��P���|TV�v}ˈ�ل�R�q� �#4v��t���xmA̘�n�4y+�G#��}v�mo.�:.��$�?�/<�ܨu��˰G?�����2���~@kR��g�Ƅ�kN�e~�!� 3�,Y��i�7�a����8�T>�8U{Ph8���#4Uh6,��h,H8F��pd���'fw�k&��'솥�e(�:��J,�Mj��ϘI�#O]B�u��j1;N��z�i����]m7G\c�Aӹ/G����71[r|�~�������<M�ʤ*�V?��5�b��<�_���R�Wy���y[q�?uZ����������:��MtZT�\���B��R�;< J=��^��M�W�ؙP,�-겶V6-�3�)�u:��!��0PLY>��6<�Yi��m4����|3����o]�]6�Z�Pᡪ�����w��)��t���%�ب݆��8���x��I)�X���#@��)^�A}���X� ~G�-74�p��f��T,��\Ih�~w<j7 �K� 1D;�AZ��kJ����a��6.Ƞk�/ix�a�DÎ�_g�Bk�E����q��e@��Sq�읧�23h�LZ�֚�E�Gw�Dv#_��4h�teY'�Z3'�HT���Z��j��d�V��Z�b`�Yvx�:��H��T�*K����xk.q��\я�r���{�����惕R��������`�Ou2�!��n�q�VY��
Static task
static1
Behavioral task
behavioral1
Sample
Updater.exe
Resource
win10v2004-20231023-en
General
-
Target
Updater.exe
-
Size
7.6MB
-
MD5
2f8e452dfeb7a0aaa4485cf89f0909f8
-
SHA1
be93cdae2f477a50d5864a0e6663e4d827aeb7bc
-
SHA256
415856e46ee74d50520c330c9db66f7abecf8140e8bbdfa3f0862abce646b195
-
SHA512
fcb5e6daeabc48cbbd82e7bcc6b5647996fd15208cfe98de7cb1efdd7826c1fd711f5596af77f899388f0e48746595b9045e5f66714162326aff4496831f48ea
-
SSDEEP
196608:sVrGMzBvVAaIjZvb4FpsNt2wwxj8V4ePSE:IrGSIjZvsPsNt2pxji4uS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Updater.exe
Files
-
Updater.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 200KB - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 34KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 32.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE