i�lO6�+4��y�l�7O_qVv/�8#\�Af����9�oT���hrYK�TV�C'M�)v�-g����,E�qȱ50��^�+�G�����F��3M�y]n�t3���=�����:+�;��Y{��\�t�"Ad����Eآ�-}�P锕�D2Z�h[��x�����w��ץ�UI.���`F���ވ�p�z�g�u� �/�>B$ F{<����S �|����x��S�zwC���)I��pA������)fLG�)�1K�/�k�S�#X[��b�k�)��IHO�w��>��0�et�}�Rđ��'-R|�i^g����ym�h&�?��tTY�M}.*�42���.g�p�U��r@�d?4rCQmM@��X �j�J�pa%�@҆|�d � H��N ���q~��yK�Y@�F.2Zw`��!�<�ށ��宆BH��?�pC��2�Oz�s�Y[n�{K6#[���/�<T���;��NqY�۲ M�HM(�V(/Y%}���m�>�&�(y��l[�C��c&G���O����s1��t{U�^N�T>oRz��L�x:e�v T�����@|��8T�������C����nM����7��ENQVP��� g���l!�ѧUV,H�E�=;�d, 2�<� �`�X��;j�-}.r$&����qqΤ���e�r7���@��{w��}�6|@��G��ɍN��gN���C��[9ޑ7��u6p�4�q�q_|�r��, r D��B����L�'&�Bֵ�Kn���}�F���~]�0E��/��)w���MW�7>�y�Y�QU��B�(g:���s����ԛ�!}%�G��W0��TJ�~�:��@{v��y �~l7����4'�����I�@�.�ڶj�kн�'�&M= �ؠg���S44���� �auSڨ�[���)�r:��Jˏ�p��:������{+=�Oz*��{_>E��̣����R�}q�s�,��Da�����4,$ ?��u�4�����HR�pte5�5W�5��h���;����L��n5�Wg�%�K��?�C�,<�I ��l~_��k߳G��`��� !^�:��d�%���ʅ��h3�|�"�p_>|�����b���b�e7~�қd��ӌ���l< E4�7�>�7~��g�!�ƚ�GX@v:���5�`6z�̱��P����H�t=�O`28�T_��xz���<`�����������&�)�;��-��N6/B}"Zå�莏B;/w��E��Kl������������09E�� PFznw�cQ���驰�����2*�{�8�����5B�9�j�һ�G�?��%��ڱb�b�dv&$�-M]0��B�$�b��w�ZVf��u5��l�+e�QK�OY_/Z��A����j����Ģ` %gY&�ۯ�ݨ��~ّ_�oe't��ˇ�0� �!b]��क/�6Y��]�/�L��w��,z�Cl���X��F0o�-�]]����7�'݀ЭS�<��a���lfX}�m[GKN��<�ʭEn�zjn�'�X��W�f q���$�GNb�b�`�\ὅ^%�u��ˀ� ���:�vt��؏�t���#���?��r�m��f�S$������5?0p���+R���(�uC��/��AT�����@�s�/��A �Vw���_ �,d��P*"�V��Ks+<�F�6v~�����0�e��C����,,����`�"a�4xKW�f��&*�:��]����[(!~�}f�-jQ���LcW*E���e�;�ua3���z+җ��W�Q~�@q����A*�p�^- ���3�Q�^ tu���e��E�(���r��/E6��U��m��^����0����z�w��1dj��aM�HHC���v�����:�EO^���bPB��9�῁����Y4!#ʏ`�xD���Է{��_��iQ7`�R6큿�T��³�. ��偺�Jg�P������W�'FT��M�$���5&�S7p�c�pO`BE��Оv] �������y۵�CU���Sh�<A�0�p5��q�&dG��IZ3|�����v�z�\�SR\�� �uc6yjw��;wS�h�I⼘��[�.�u��N�Z1P��d�6�}R`�y>�VD"[,O��G��8��jvi�g�2�V�f�e�xI�#Do����=U0�5÷�qv�^g�W��9!���{����W���hP���B��Q��#v9�(� �ۂ���:�uF�ݶ�߲�o�O2�'�0��J�ۀ��@�|�0��6)(���K�C���l��6����+D�E�e9i���]���k��ѧ�=�?=o�B-�FF��j���A)X�&�A�mD �����0u ����Sl-�N���|��f{w��/������T����*��x�u<*+�K�ܖW�DR�W��b�W����O�_�o^��y��4 �q�����Zq{��1��9�'U����&RΈ��_��A���ƅ[��<�x��@@� �k ��ZJ����v�U��]���ț���m�@%���ؚ��ߺ�6��CKsy��q� s(�GeɄ$B6˘2��@9�j���0�e���H�+�F�����cso��2���ZC�k�w4[��Ϊ!o>| ��$hݕ�LL��Wcڔ�4� �HY��������zԃ-e����l���0�%�ur�X��� }i9g��>�0!�c�d^���;�;̗�w�aVJ��f��z@{_�yH$\��։���Zع�m���%�����+q�����Ll��C`ds����Q�Σ3���>� ��nA<M/R(�4��Z:�%.�zD](�x�L��&��}ƣ�8�����H���k��蒰,VHZ�s�(�+�l!���;!�%1ZăD%ǜ�J�cµx�_�}|?s��=�0$X:�p2!��"M�_������;�ח���ۓ8��w#���v4H�w����tH�g*�I��CT� \�j$�����{�o�"�_v%��0���10��������\O)�\d�:Ral��X�e�u��a�Õ��v}��
Static task
static1
Behavioral task
behavioral1
Sample
beacon.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
beacon.exe
Resource
win10v2004-20240226-en
General
-
Target
beacon.vmp
-
Size
256KB
-
MD5
b6ccf0d5ccf6551eedffe5abe1bf437e
-
SHA1
ec67aab82e91b587b1718180dae7c93b4b1028d5
-
SHA256
b71de423aff03987d38b57d4eb31831c395d6902f6c3c234d111a5366c3e116f
-
SHA512
86fc4703693348d7e90d1b7444f016498da0f4f2a6114707c04c37ef4341b956dbbdb145a1160f9926e4e240f9ff3a262a77b01c7a2dda6c47ad168b4f5a30ad
-
SSDEEP
6144:ozDajrZSfuwZUvwuOnYPiv8lv/EVM3KulOqOOdJCJFG262ixOT:GDajrZLYtliUMlV6JFN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource beacon.vmp
Files
-
beacon.vmp.exe windows:4 windows x64 arch:x64
b17f9663f895bd9e09071e27e0a662e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_onexit
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 254KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE