Y`�P������Ȼ���3�U�����ke��>�X�bWj������D�iv�H���� �3��R�+��g��<��IS[��������Y�L�����a5zd��jw��^�M� �{4��/�b]�Y��+C)� ͬ��*W��QN���o�E =s�ʕ��D�l���4'�A��i��� � [W3��lGW���Χk�d��w%�V���p#�N7G��vZ:'�k�]֣J>)�r��̐���Q$�"<�����+���R8�$�Dy������j��#T�g�^:��=L�O�F�Tj�Ҥ����/�k��z�p�b܍�����>����h'C�� ��ɛ<|`f'{ķK�y���g��E���SH�Ȓ]/'���<��'Ov�-V�bYYv������z_$�r~���A�-W�+��U��0j9C���� ?0�A�VG���������u�3D�"n�y��3�0����m����X����������.F��3��@Ů7����?n�~3��<��->hK��qU��K�[/M�]��Q*j�QE��e+bJ=��v��q�E�3eT��pSU�&��F��u[(�A�=��1�37 aP�� ~�9!�`���i��m]CN�*dמ��N����@"�� +�Q�Y���� �Ń f-����U�"��t�Y����!ag�z%g��,�[�l��d���LL��N&��r|�����F��Wk��[\��@�P?��1�����N���)"��Wu'��l��� �������Ǐ���M�l�-��Op��U���>G��'�� �:4��xh �I=!���Ei�MNX��{d�lu�[5-��X���a�Q����W(�*�v�����,�Ն�;������!4�Dɳ���3I�]�y��Z�����)'#%��=�x��iXE#q�P����S.k1��#"{[p���y�y-s�/� 7d���-�W��9!��1�Z�l��0gۖ��������7�|Ov��R 1m������ �3�VJéO1������X�4xB��2{��z�����y�(��e��7 �K`.Ȼ��]K=���U�K�y��]k�P-��H������P`��e� :��a~~�~�D�~\���#���`$L�=qngI�����zѷO����\��%���p[�u�bw�A���9�� t����|c��=?�;�`��*o���#|ܧ�H����祰�l���C��r��<�G9F6%���~0���u�\V�f���6ʪA}��Ú;�S�vP�u��5/ۇ�7xXi ��}�n�8�h�( ���ꋫ��Q"-s���D�E����@�}������(�(S?���WE����OAJ�\j:����hd���?'J[UY�Ay>�����!P�?���+���-#|2��$(���)��a�:Q��w�DΎ��P XK'+�(e�QSyD��.M�WE�Go�ݜx]��BA��R٣��F��֝R<�LR��v-��-1��Q=�%" �^{7cK�ki[��ެRfG���1&4���ܵB�H��3c÷/ �JW�I�,�$fɖ����z���}�2Me�9\�iB��5Mp�{���D�|D��Y��8*�4*�4mh�'�`w^+��F�S�7}F�� m5�#`�n�x���yK�Z�A&��ȼe4 �MU�^��+�;v�ezE �%xDì�d.���� U>��?���[�:�j�n�'�<3�;�*@n�5��Gm�J��O��k[���S������8s�6d��>�z�e)ES{p��i Q���Ms�y�!��&6*�����{K6�/i�)sL�\�{�/ {|@d�Y�ԏ?5���{_ynGЃ�. (3M9��@e�+V�y�[�3�"H��R��W�T�b[m�^��:T�$��呂�pSC�/�;��Ɇk��̑-����&������x��fMV��F9��FSK��;����>3ߧX�`��a�Bd���t��6�+Z��5� R�3�R�rheeuxqwn�=�+��_n�[��<�B��P��-��8��dDNsM`��O�E�"=��#&��i98t�Q�:�l�Ү������GyƆ���H*�+�^�:ʤ=b����m���TO���J�ve�}2��o �!_T�i�̀�S�����^(�̩ԑմ�K�T\����\:w��8w�hQ���@�,���·��kVʱ9��R�� V^P,������ �������r{wH�v� l���6Z�C�]+�D� 9�Bc:^˻-b�:˰.���ւ�eu���y��:�z� �Q�&ˬ���m[p�8ϡ���u�t� �CQx֬Zy9)���ihG�f\h�>sJ�dZ�c�X�QN���c���E7��GJʔ� atC֚�w�2i ; ��e7�f�<���y|�4���Qx�ɢ�x��:7 �R�OI؍�ru}0��������س�M�����r/�G�����C~��5;-~����d��T.i�?�n����F�!�'�K��no��|@��:��#F�C��{:�cX��[0��M*��JQ ��Y���� ˤUXS^F�aQX�dtS� )�U"����At�!-ɛ;E�����R�'�bEA���Fݩ��S���b����LS&��@��A%�ax �K���Xvg��O�&��%�ZH��G>1ן���lN���+˘9��G�[,jq����.�P�����M6.O����R=i�iry�aҨ4�p��� �:9��B~�\��/4e=�tz���a�=�����[�ü(S���m�r���a��M\ŴJpV9�;/2���H�bf5�-�p.+��Ԙ l>C���u���o{u�5fŬ�'~J'�$�ޏi^����63�V�LbIO���= @�V<��}�B��Տ���9���:�����s�Y-�Hkݳ'<vʱ�P ��A,����|��-� ��Mtԫ ����u�|Tw����2Q�mFp�����,Yk����v�r�%;۠.��r�J��T�"G�P�?[�So`HuR�摽8p�V��8�X �q�J*�9��-;�K�h!UG|����2ܮ�
Static task
static1
Behavioral task
behavioral1
Sample
IYRSK0EXMIQIMT0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
IYRSK0EXMIQIMT0.exe
Resource
win10v2004-20231222-en
General
-
Target
IYRSK0EXMIQIMT0.exe
-
Size
8.6MB
-
MD5
df70cffa42f7dc750787f2e8c264471d
-
SHA1
80133cc2e5b3ecd3d314e0d0c2c6306dd90f704c
-
SHA256
f972bf02cc5f8251cb0104d93581f357e46c680e817f92eb229bffa7711604dc
-
SHA512
bee249dc4ec9702b61d834a9e06e45dc0c60380764374e6a79f62f7dc8a15bf0ffc3b98fdce91967f28caec99c55c1318fd07a2bc1791144912757cfad8d330c
-
SSDEEP
196608:x7E5RuVqH3qXlN9f6pepElzWFSU4Nr2P+5yL9NXTCdM:xEPPCP9fBmBVUK2LZN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource IYRSK0EXMIQIMT0.exe
Files
-
IYRSK0EXMIQIMT0.exe.exe windows:6 windows x64 arch:x64
084287f1c4d19b23ce5c110f8e3d6fc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongW
CharUpperBuffW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
normaliz
IdnToAscii
wldap32
ord35
crypt32
PFXImportCertStore
ws2_32
WSAIoctl
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
advapi32
CryptHashData
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.|,l Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tWn Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.[&1 Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ