�{`���<���Mj]N���=�o�!��D�:�r�1-F��2�[��Ǐ���6�\��F��?s����������j�c����[u�[��A6C�\�þ�����NL�� �h��u'�ұH�\��e�G���NلZ�{E{�t$��R]�A[8P2S�ԋ��$L�p��sz�t��ul7�pp�����bM�m�*�MX�ĉ��1���#��}���@`�ŀF �vE�zl�J ������i�IQW��V6br���tNl���A^=�Q+(�{�����%��l*�.|� >�a�:�`5�ϓ�I6����|$i��W�˄AN8��l����"��b�/���3�>���#��>��>�]�����j#�kk�3.�Y���^G( ��4{o(y��>�ш�nJ��D=��+�zl�=y��J���@#������̢$S��Z�v�C�9�7qh߷2�֤\� E�����%Iݢ���=��� �����KҚ��"ٲ�sѕh�y����c��7A0,�s_ZM ���gBɈ#��~ݚ��0B��Q�J"�W�D�[ ���g� ;�T��b�vg��A�����~Ԏt�)m#� ���gk����?&����5r���Z���\:&1��W������wbP�M�/s}��^)��B�m�̯t\;oe|�w)��2 !�~nڃ!Q�$����g6)15f� �h���M���rf��d'3?:����3䚢': }��^0)��dY "��>OEa$�� J�ݮ�̡�}%t�@��jY5ϧ�_I��:��ց�!#~'��=ã�\�;�c%��"{������z:���!�M�+s���K2��*�� (n��(���n� r�F#?r%��2xd �r��0���1�;�b ���qc�Dպ�YԈT���ޒ���CD(�}����]#�E&fP��"s�JF���_��"�)��5ưmsnJ�c&y��Tq��� T��xHT@|�&�e�+u!�=��[;��� 3�l����]�i�/�/�|�ʩN4~�_��Q#����Y4��r����nj 1�'o�;����q�4k)�1�3�\5�>�?^�G�~[�Z4Y���U��Ce,"4j� @�r(ȱ#� 2#!X�O�zʴ����e2|u��$��h�шDZ� _���#��lj����^0��@���V��T;�ζ@q��]B�VZ�%����x�V�F/���3=ͪS%�ͫ�J�`̰�X�����p������>��C��Z���s~g�P�ۧ�zk���f�F��kr�͕&:f��IJ��i����Xq�>���-��'���R:��j_l���'�T<���g��4���{Ղ��b��Tr���8) �mas����1q�F� ��D��ě1,R|��P�'a�r�-$�))�C8,s)�\E��7�D2y����V] ��4,U�*g����w$�,@�gcǢG������R�C?��Y%��Sڑ�6��#@����Z�1'������VK��+q����H8�0�Yu`���;�:&)b��2�;��~���%Ƀ����9���\��%�]���tlt��5'��9d2V�-��HcO ���;D���Ve�.Z������f%�ݧ������/�t=*�铨���0�yL��� �Ne�2j�t�y�y��1�d��r�t�����p,��`�zK��]���%�����p��1�T֝�,� �� �(BC^�j�����rBAc��u���g�HX)�I�J�{�Ql/-�I���U��v��~��� �nj�(����m)�qq|6FuƋY�?�M������s���Rc�Z0���O�g"�"R_#��vH�ѸfMƚ�!�/vN��� ����ˏ�$ h'H${~�2N) 8S~���!����FUU��g��,�4# -Ŗ<��@����ޫ��W� � +HCt�%Sb)�4�M%P�:�]䭠ZLi�!�Ɖ����+�T3JU����mD�/����,�Y�8���ϭӓ0<Uf#�c $��Q=�\���۰�wʠ�>���S��������?I���fi���R�A��.Nޜ}Q��s��KJ���~�ŵt�_g���K�]Ŷ�� �4���g![U�fQ�ĩ�I�.ͱ]F��L�H6^��J/�����7�48'����=C������ EH�(��P-���`d;f��c�[>a'c`��tB������}�����nZ&��/7��?>�g��Qw#��~[��my(X���u�tm��6���u���{W����8��]Rn���8Er<=`�3f�0��V��Ԉ߲���#\�4}�xN�zb���-��x�ڝ�O�{r`��~m� ��R�����| ��h����'�"�8��^9�x���1D��L���@J��֟HE��D��r���;>�*-����o�;�E�qq��h��qM��m?.�ԏ+����?��k�T��)�����d���Z �;��K���F���Pʉ��)��3 ��Wb<,&Wz�����3Mə����1�h.�aʇ)�.�N�F��O=�H���?��?�=�Ɖu�k<(����Z���.v; hY�.B��D��Pb�CM�]�p���,�ɱ�x(I�s�ӭ$�gJds�ܚ��q2�=�:gXid�=T�h����q'�pmRP���;��%�:(��$5�v��fd���'B��բ�KI\ �����}lR,���C4fӉ�竒܍X��T�Pc�q�TZr�?n�P�Xr5��)�5َ.l�r��M�s�� ��ʋn>���ĆQ�P�!Xr0(k":Bc��F�뭢�j�^�\T� 5��Mi���ػ�7f@�z��j�Z�PA�c�n| '���h �(�Z1��T�<�"H�(�r��� ���پ�_�+5� ���t��gR!���M����V�,d$���#�D8��������u������ ����B2����n�-�����V����K5E{���}⩦^ ��c�"���rlx=��|ŏ�k"DŽ躭���S.����Z�?��,"�$s��/ۚ(�����V�f�F����M�_��]�x�MY��R�ulc��DL�n�r"o��\�ǵN
Behavioral task
behavioral1
Sample
Login.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Login.exe
Resource
win10v2004-20240412-en
General
-
Target
Login.exe
-
Size
18.4MB
-
MD5
a3a6823cadf506c2cbebc4005737c7e1
-
SHA1
370edf96a3d794073773a57ad5c249b2371528f5
-
SHA256
27bbd5e10d4e99bfd87b6b89f7caa5ac96281afb9f5c97270fd757d93272e717
-
SHA512
d52a114ed6ad7c33aa2966af3f07ac897506f366678079209974480b32e3a252a4579e7ea7580cc4901fb0f35115fd8835e65910e92d7144f42c177e1791a14b
-
SSDEEP
393216:0HjfZ86nYRFnIMxzimxrt1GtN+qT+JtD+1H2oCk7hoB:0DfZ8jJzimx+NtsD0H25kdo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Login.exe
Files
-
Login.exe.exe windows:6 windows x64 arch:x64
bdcbbf1aba5fa77bc0036856b8c6e89a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc140u
ord1755
kernel32
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClassInfoW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetObjectW
advapi32
GetUserNameA
shell32
Shell_NotifyIconW
shlwapi
PathAddBackslashA
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
winhttp
WinHttpReadData
vcruntime140
__std_exception_copy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 18.4MB - Virtual size: 18.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 991B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ