�]� ��&8^R�lR#Q��(|XC�F] ud"�Lf���/c|j�ր^|�{�k��2��e�O=�k ����ZB$��oo��AY�:���4-� ����4�1Ju�蔢F�B0�U����Ĥ�@�X��YSs}����R�C�I��ia����Át���3���%�l��j5,�~��n��S4�t��ЮG�G#�~:2<�xxk ��F��Gj|`�ݰ�@�MWa����ǵԛ�T0��OY6B����ϗx�RB�B�J�ᔅOq����*\��r�;R\�pH��#���0�Xq�����b��Zɶ>���6�}�������>������2�� JŌIK�lb�K���� ���c1_���j5#4g�&C]�ւ_z�jd�)v���w�Tj�#��J2���x�8p(@ܤ�M�Q@D:�D>��K�M؍�:P�����-X?,��8���j�,� �D��0�ڵ�7�o�X?FX�s<�yo��K6��QH�R���.��`�-�1�@�/��s��/�p<?��7:9�K��C�~L �溕1U�F��2zrt��T��n�G;�C' �����SG��j�l���<)�&�]�36�>�U�����}��*���R�H�5�"y�7�$pHנ(�!�SJ�P�$����uɭ��V�"R�h��(M�.��m�&#}�����L:>���w�(Y�Y7�6B.0���r���ҝ��_G�Y�I��#��5�$���̮�xPB�Z/����IX>�����촭w<]z�iG��y�>�OԨ?œ} �.��5+gi]���g A�O���7�<�_҂\�A+t��t�'�WS�����ԁ�T�,�O*��r�b�z��eS$�S����䈠[A'&����7w07q_k�W:[~�˱�DѪqh�C7��y�� �- ����ӯ\�� �sS; {���&8-�Z ��8�{��Ň*�7��O���yZC�{� _���%&ޢ�(��5���v����qܞ�l�Kq�L��S���jI_)zA��v��ãb��������ń$n���G��� *��E�(=>$ 9��VM�ײ��8� �sݣ�ʯϙ/w�s۬,B�?���A�Zs2�[&�6vɰ��ʒ�0d�=�s��ʩ��+jɉ{c>\��O��J��$���Ȱ�8�3b��v]����2���;���ru����&�<ψ�n��tHP7 I� 0 ��́� ����p�$/{���:����f�]1pϪ��Q�Q7�XrM���&IёG �6���j��ңI�e÷>Q�r�`xOi��$l�i��@� �д��� ���dB�⳯����\-x�P{���G=�Y,�T���l����zy�f��9��ZE2n�1B�l� /}������l����K1�!�:!��#$h'���nF��-4y �H���_r����:,��'��Ȟ���'��LDdF���*��.雍4� ��F�&Z�b�^�&vJ�Bn�}��2)s�͟hzJ2~���o�a��!���F؉���M�4�uE[x�5e�M?�F�d-$��(w��i�ŀ�o�M���� ���*�RBUc��+|���T���R0a8�@o��w�4�4�\$\��qA��m�("ט�����1��h٠r�x��輟� ���k��%1��(�I�l4:��#���Wk8p���j���s�Q��R������*�B���@�gƅv�����j��I��z��M�T����R�����@{)���!Y~�4SIfc>��s9F���1�o����x���jTz�=�n�<Bn3�Cb���a���3"[��_O�.�1��^,rY����l����!�� ^̶�d�W|Z�Q���U���'���F ����hИݏ<^u��'1�P2����xM�ؕ��p6X��+�u�XsǶ�Ŝ%�v���/��g5�S���<AS�Iı�Q�(��"��͞��FX%TXQ����qB��q�\#��f'�q;�?�E� ���a{k+�b������kW���@���l��4��N�Ka��#L����I���T�I��@�i2�!���սG+tdɷ���q�`�����)�N?�(��0Me/�oA��z��J�NyC�wX�!�ә� 9�U���`�筽ʂDn�`����^������#b��A��8>7 �j����5^q�r�A��p�ޮN�>zZc�.3}��* T�mS����d�5�.���L ��b��D�C�|#|X[���f����sS��u����\�~7"���gq�^U|2NɓK�+S��"�Q��D�����m����G:^�=�8��zP+4�G�Y:(��0{�p��J��K�H��q��n?|~�z,����ޝ��0`�ʟ(#0��C��4�Z7��o1d���q��f���� _����ڟ _f.�P��]Å�~x쩡z�N��Px�-�!%���>�0R�Hk�'�Ҡ�zK�m���X�ڶM�o���0k��b\�0��4�'K:+m=��4 Ʊ��/z��{��Qq �����b�?�c%��J.�-�8:�]��)6W-n`�}�UPn&Њ�.r�Ё�0������\�����7�ő�%VX���)Dln �"��A�',_A��c�pf�1�;�W���SR�A<ǹ���M�hC��)|T}��4|;���8�8����}�p�%z#Үyc����'�ƽք~����'S{ѐ6m�;}:�U�ߛt���o���`F����xA|U ��zgo�o� |�:Ȁ�j����7ʌ^��Һp��실<���NO.�D��H�1��Tn}���g�h�g���<^��FDI>�.s*� '�+?��������Ze�c���r�U~^k�`���~��������t�?�5L�v���h0�����_�/l-K�?�ɽ�,�D�\�Cy���~���p��r�Y�V�}��obb� �<ˀ��,���Y,Q��H9�S����h \֎B���P�g�q�x�*��,� uڏO��GeP'�yx:!���B��}����q��ȇ�ث���i�.�N����K�o�t�o�pm��H ���~-�9dV(xA��YS�
Behavioral task
behavioral1
Sample
INFERNO_PRIME_V.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
INFERNO_PRIME_V.2.exe
Resource
win10v2004-20240226-en
General
-
Target
INFERNO_PRIME_V.2.exe
-
Size
7.2MB
-
MD5
341f2972d4827480a7ead7a566432945
-
SHA1
bcd147c7a96203a0d47e9c052544c2d5d2180f8e
-
SHA256
9a06605bb5ebfefc54112fefc3da1a4d7f136b1241898f68cfbea7a73eb588f5
-
SHA512
b616d16f2d11f3c0edf2dc2ef678fd60cf83cf376fc663a8c0c43cf67fccba727684122c7e5d321833509bf1ebb736ae9154733f249332e1203e34a7bd5e7c6d
-
SSDEEP
196608:y55Sa2PRp6ptyLWoVjjmcTcBaxGR4v9bO7M0sxn:Y5mpMptyJV2KxvBOgzx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource INFERNO_PRIME_V.2.exe
Files
-
INFERNO_PRIME_V.2.exe.exe windows:6 windows x64 arch:x64
Password: 1
fa3ceb1a4c32ceaa1ad80842fd4970eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
ShellExecuteExA
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
imm32
ImmSetCompositionWindow
ntdll
RtlCaptureContext
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord60
crypt32
CertCreateCertificateChainEngine
ws2_32
getsockname
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
acosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 685KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ