���_����焿z�'2�Wp|]��Z���$�'����l�2��k?,l$^�}�5��2��k�����p���w�f��u�d��մȤ����v@�-&�j�&@��tΑ��3����Gx��B�喈�qj��#�.��O�;iZ1�F~x��o**�]N�2r�B���L��ӈ+��"����T+~O]$���1,��J�����-d��{��ST�Hܣ��>�oK��Hh�K��PoW��"�'��O�����D�w��� ��k��?�2���j�h+ct��vg'�|#P�6b~={dB�������7��[��>���k�q� ��P�d�tY����,��?Q�b��_�ѷ� ~<�� ���)pߧ%8����`8T�o��������Pw$@���+� I�R���[�C�a�����>���5����D��^L�u�|�R\;XU�W�'!��҄�n9�������@���O�����2�Cu�ԋƦ���Qg+�{O��|�g���v�I�� ��������ދ��1�^x�-������1��@%HU�Cplש ����C��4TdA�V���t��Ku���RA�f��nC�q��D�����4zX�k�7:�G�����$Y'�[V'^CDќ�Z"z';���#{OrKɅ��Q_*(\�%��m ͤ�6tĆ�}S�i%��h�V��Z�9�R��[�[y�%��8�,�h�~�D�Z�����4r�܆�Dt�n��Gd���l�kD��C&�{�)0i�J�0+�R�V��0�_ ����2=k�Y'�.���[� M:[_.&�a?D떠M��J����6$������ˇh�� d "rfU��wwgxI�S�>��P�yg��: ���K��>�����ǫ>HqUt(����u� )D�2?��e`Qhǥ^�iiV���ÊID�L�.���� .|f���g�><��� "g�S|�����)�B�vD�#�N��G�E����>(����MX`~ؚ@Վ�ɺ�U�_���pN!��(_k/�I���{��+��e*����:|��D������g/�� 3�{�'�����v*BK�c o*�p�`�"�G��w�i-�`�f��/`bX�Ҏ1z��8�zԚ�:�@�P j�F����F�&ٱ��k#��c�vc�ɠ��^��ޅ��㋽v�f3�M�+x�u�o��@Ciǿ����[���0M��2���$2K�F�# ������cC�l�0�H��eK#���N s�ݿ�c�\O5�Q-���(G�i�k)�,yjpe�=���y/�o)��F7��"Y���ú�Zޡ*üY��" �j�E\��^S���\A�d&�R���R���l���J�[���ReN��f��c����xa{��G��*xNp�H0ȃ�O7y"��k�����3�����F��r��/��H2qZ�M���+�S� LQ-�eF6�g dm��J�Be:�+1�J�Z��n??�ҫR2A���x#��?,^�� nu�wCE�y<4���� a�����U��^�i��|���ё���m���� Jy�m� �Vv�P�4�ʃ&���VwM�t23h�h����}P�^iq+���9�[$3�b�mB~�,���U��-����X��xĄd�x��j��$/<Ϣ��P��qe!��X.Ż˗Ԇ4S�� ���[XY���5"�v��2���+R=�u��`ђ��>GA��"�v_�`ʔ<����R�<�\�J�P�����=e|,���f$N�� �b�=&O�; �جr!Q���'����z�(�M@��`z��l���şuS�춵ԍ�����}r��P�^[ȑ�q����~�zDw����͑`g��>�@>>)(E�;S���|���6_3�G�sc�~f���]��|4X ����/]g����A��������D��dh��ӹj7��u�#i�����DŽ3�l��U��y����'�i�{l�|s $,/57�Fa>�l�,�d�T֪a��JI1Z������Y�Q���� =6E��B5���>]�Y����/�k�Qq�1QxK/:\|C4I�=kh�OM�kr������ ��}����w�*~�Y8t6w�F���QpV��d�_8�Ì�,�]�ol�K�� �z~Y��R��=�<\�r1I�P��d�*X3��N��hI�4%��Ն���=9�P�0�f��O$&�v,%��2��`]#xZ��# �� �%��n4�H p(6� �DF!��x�Fj��p��B5 q(���!��o�0ᭌMd�^��T�}�Y�>�vB0�?�]�,CQ�M����,%�g��H�Ğ����=�k����Z��Z�#�y��� ���_ق��� E)�V'����ܾDN��͞����RD�� �@M�;f��>,L0{V,��x $?���v�. �z&�E��� �H$|M����3� _T+���")A�t��ܪ=�ê�=l@RS8|^O;�lF� E=���ɂZ�\1�t�������$.r6*��ש/5�u�ч|A�B]� z�e�%0Q����0W�� � �@�y���(�V��>��h�#�j�Y�8Q#Iz=�.h���gk�P9�Vi�H �@�\��Jwx_��B88��s/-�ӫ�)@��'d��?ɲ��V�5�B&���F/�"Z���O+��5 ���O �p�ZS��n.[Ê�>��u����s���n�A�Hm���b.�.����_������p�y�{ GM;��d���l��Gx@��_�pY��b]o]����7<�M�b��D��ш��4,�xE)>(|0S8H�1��j�g�g�d$�8%�E�'�w5U���R/�Q0Y��Ce��x�r)������qb��K}��`w��M"[q?ցUƆ`@a&����H�o^��w$Y݃���$v�rd}�jX����'���D6���,�iĂ+�f-��+=9�jba]G=R��-/�ۤQ�|?�������D����jؽTV4fy��Tq��p���;�{&�18��{���FvӚQ�&<���I���:>V�G9?� ����f�Q��i��0�����T�����,��9w�c�҉i���H�h����[r��$\෴R�3��ê0�8�:�È���:�=��t79X���I�gj����WD��9�gc:�4������OvfJ�y�X���pR|-P�;?9ϳR��+���u$J$�ɠ�c:M�_�b�˟e �D�x��bx�,���}zOw+'��>,zZ��Z�`�>:�ٍ�F�^�=���!2��G�%�:�����@r����g'7����Q�/��j Z��y��ڟ¡+�N�ɋ4�#�f�Z]��]/vb���'D�@�-p�o&{�`m'�%�bԸZ�K�Xh�c��;����d:����!�>�fZ�Ժ
Static task
static1
Behavioral task
behavioral1
Sample
MonolithPatcher.exe
Resource
win10v2004-20231215-en
General
-
Target
MonolithPatcher.exe
-
Size
2.9MB
-
MD5
3bfd03c56948608a4514fee828483db0
-
SHA1
c8c11703cdd4aee8a07e3218553c0d04a770864d
-
SHA256
f08295d42656789488a715929761447d94c86d9910e06751762a331e3fbee915
-
SHA512
f087b8fba49a4c828391364ca9e93f178bff91feec563c70cc3c8fc75653af1c46d627e50a901cb88c477d8c46dac3db943d90c51ada70324329b65cf0a903d3
-
SSDEEP
49152:/3tBgrHXW2q/RBrxLKLb1HIIV7M2HiocKGixmay/Iq6gnpZsg7P3BQLagS0IINCl:PtGjXWbBQv1FLto6+pCgbxQLHe2qj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource MonolithPatcher.exe
Files
-
MonolithPatcher.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 281KB - Virtual size: 928KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE