��Y��ȸ�SZ�d��h�o��>������S��"v��&j������G{����æ�� �H��������Z��N�������١hV3�$=\De>gП����s���6�4������եX�KT r���8��� �S.[��|g�__i�Ĝ&�3=Fhe� V&ܦ����YiG���}|�}"n����ݨ:�y*��oV��i�w�:�s�#�0�NߘMֺ���9~Ow�=4�Ul[���p�V��ڧ}�sƵEo�i�0��/�m�:���>�Ľ~~#L�0,�� %c��)=Ņy���4ˮ-=������Z�(F5�"�%��do���z.@����q����H+�͕�䅬���F��L=��p��*�B�H2��-��g���m��DU@^�����ͫ������y[�a��f���?��NC�uF�P�~ʅ!�h����B��ST���k�6S<�R�����6�Qr�Ɔ-H[X�ui�- /���P=<�W$S���R߬*qVab���-�J�¾�5o�rg#x����5��Q��5&�Ҕ�¸l6��G:�[p��9�i��͒!s=m�����F5Er�_1��Gd�a��J� ���Q���.��-�tմ'K�?�]�=���Q������2 ����r)�b�q��m ��w��ݖL���цJ 7.���¤�ׄ�ו��Ai��fm?t}(� w������;�ژ�;��͜�LI4���'F8����js�:{ Hhpou.����x��(�]���y��&(<�-W��-�[B�Lg����zפ �m�O��c����;W�4o��.�~FU�QfYI@\�������X��Q�+Jr��5hXX_�m��v�� ���� �E4�~�B�6PX�ၑ�e���H�X.�´Ex7��_zA�)T��H��)���tԫ��i�m���N����;I�K����)ցsj�Mc����%5C�aw?XQ1:D�X����|�y\M��do�BoUÞ��%eY�h�c��>�Ȁ2�'q+*i(}:4���Q��w�O���(EW�PH9w�ȶ����۔�9����Xi��6G�w�u<-��e��t�܌��v���D������խAe��VO��3�e���e� �ڋ_YX���ZF�B�n!uD@G+a�u�ՑL��d0�_I�ZRV)�8�jb�������r��Wܸ���<���Y�v�gAY���ز�Bm�wu�I��8�<O��5�f�`գH*u���gg�ㆇ ��WbBL���H��f��w��q<��珊�i���a=����ʓ5�9S���NQ��jM���k�&;��p���I���͖�TE�����U#��$�ξ��R�@>W��φ<�$�_�����8y������m��76��Z���F���B�5��'�F����E$/B�ݫԅ������F�˕�����G�Q�����z,��]1O 1��ZS$�ش�9����نd��`3V�m���cYn��t2c�|FH-rn`��ៀ�#��w������T��b�!�����.����b���B랢���'T�Բ%��)��1�j���M_G�R��!Oc�մ�#���g���heL�\�2d8�/�rD�����[�� �M�|��r*�*wy��i� tr�&��B��� �4��"e��ʉ^�16�)�Gb�����,{���1\Z���4�{.��ި@���[�~�ҡ�Ҩ8�"'��������ۯ��N� �զfy�R z�~�z�~����v�V-�3��)Q��P��PIuh&g�����������R)x/�.�y=� s�<T���L؇Ze�q�uhԠ3ICsW&v����Of�y몝"oQ? �3��6b{#���<=k�����|`F�"�������h�Gu����e���&[��~�C�FuE���by6��%c��sOL��q��*&��[�n����e�0�������Ӽ��o�FI�onC ��6�����W�]����z��:bĒ������g�!,����p��,iٜ�xC�s��V6]<�ID֘����L �* U{��N4<��Y�m�W1K~@�?�����<���݊�Y~��5���=�XY����g�ZG�e�}/�@nD���N�K�����������]������7����RSq���`�3�@+k���L��-��L���aw+&��Y���L�]�z��Qڿ\��ˏ/���Yt�V8H�<]���S��Π����t�H�w���K� ʥD ĥ*]*Ԑ�E �����S���� Gũh���w�~�(c-�p~WXmuT���YeG1$�k�\)CDŽ|��"����<�v8Ry.v�͆.>N_����#z�����UĘ�� �2���x� y� �P���|�㒽ȶ��ɧ�s�Q�mV�j��7P����{���û�� ���X3B�d���8�����`r�l���A���N@���g;���*[c�@������:������?w�k���} �k��� ��}���N�����Ҕhn1���T�U�8������O^�o�<X,���`��y�VG��̟!�Һ@Q�l e}�U����x������@�J���w���ϪK�.1^�� ��oؘ�O�2�#���z�n��/�Z�.<"^�����f��!�]����п��gz�3͐:���l���O�� 6��W �f�[P��!.�-k�d1|����K�������o@kbk���_2XS��~ ,���}�5yV8�JA�U���{�Ȉ��!��x�X��n��=v ������?W�_xyr�9�;�;��!>;��~� ��#���x~�D�$%$ǵf?�_4�a�,S���G��[�GX��Έ:�l����͉��3�/��j�^�E�k��u)���L��y��O��B��t2���t3S��{r ����O=��֜��~����(ص�x�mS��V����2 L��l��TF��^G� ���-���$��*���ԇ�S������b�|#�p��k�\����~���ݥ^�� �t�\<���^d������
Overview
overview
5Static
static
3T20�...��.exe
windows7-x64
5T20�...��.exe
windows10-2004-x64
5T20�...��.url
windows7-x64
1T20�...��.url
windows10-2004-x64
1T20�...��.url
windows7-x64
1T20�...��.url
windows10-2004-x64
1T20�...��.url
windows7-x64
1T20�...��.url
windows10-2004-x64
1T20�...��.url
windows7-x64
1T20�...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
T20V9.0ע/Tangent_T20V7-V9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
T20V9.0ע/Tangent_T20V7-V9.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
T20V9.0ע/װ---�.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
T20V9.0ע/װ---�.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
T20V9.0ע/CADʹý̳.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
T20V9.0ע/CADʹý̳.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
T20V9.0ע/-ѧ.url
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
T20V9.0ע/-ѧ.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
T20V9.0ע/.url
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
T20V9.0ע/.url
Resource
win10v2004-20231215-en
General
-
Target
e8653c085a0dbfedbde3f6b911513d388622f14dc348e9f87b68f94866b6127b
-
Size
7.3MB
-
MD5
800fdea702563b8df47452358fc1c38a
-
SHA1
99a1d5d4eb81ea951d76f1829cf739ba3d9dd397
-
SHA256
e8653c085a0dbfedbde3f6b911513d388622f14dc348e9f87b68f94866b6127b
-
SHA512
ea91512dc6d3555207a6dab10da9244e7d76ac6777c58d8c8d3e416f1fb8e46521e89fb0ac123a3bc2ce62a48d478d69c17b518e2e62b8edf681859143d73de5
-
SSDEEP
196608:z2fbA91PNhjR+zpA6OkyKBpdKPAUQqB52MBiL+Hk:ifS7jR+9A6OkBpcdBEnyk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/T20V9.0ע/Tangent_T20V7-V9.exe
Files
-
e8653c085a0dbfedbde3f6b911513d388622f14dc348e9f87b68f94866b6127b.zip
-
T20V9.0ע/Tangent_T20V7-V9.exe.exe windows:6 windows x64 arch:x64
784a280cb5c0c512cee5417490a664c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnpackDDElParam
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetLayout
msimg32
AlphaBlend
winspool.drv
ClosePrinter
advapi32
RegQueryInfoKeyW
shell32
DragQueryFileW
comctl32
_TrackMouseEvent
shlwapi
PathIsUNCW
uxtheme
GetWindowTheme
ole32
DoDragDrop
oleaut32
SysFreeString
gdiplus
GdipSetInterpolationMode
oleacc
CreateStdAccessibleObject
imm32
ImmReleaseContext
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 640KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zaas0 Size: - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zaas1 Size: 7.7MB - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
T20V9.0ע/.txt
-
T20V9.0ע/װ˵.txt
-
T20V9.0ע/װ---ʴ𰸡.url.url
-
T20V9.0ע/עͻԱ.jpg.jpg
-
T20V9.0ע/CADʹý̳.url.url
-
T20V9.0ע/-ѧ.url.url
-
T20V9.0ע/-ɫ.url.url