2 ;b���ռ��Fs���)��,l� IGՑcu"���%.a��.�����i/{Hم�L=$T�+����yF$o�#"�q��p����z��08?��c�>��2�{�̥$�.��`U�P���kC�=1�<��P��rHi�Z��}��vy�4�K��pn �{�Վ��tz?`����xk-��●��+.��E���qX��|�Z��i��^���K�q9�(-�t��+B�@)d��,�\��y����[�Tn��ԧ��L)��� b�����q��l���y0z�Ⴑ�sۉ�*��tΩwYJ��4�U��MVg�G �)���ņ��q"�Y�y�&��n� �]͚K\GZ\���>�Q��!�QeN���t�W&,�{%Gެ�n�[�VCg��#��!u�=V��/�}�#����a��g܈ :#�I���f��ۺ��(!�ՠǎ?���L�Z��S����U�F��8Y_~�LD�:�JJ��j7�l�>R�E4��ű�<U[���n���s����vx��� �[��V��|P7����]�?�g��2�< Y�E���ShI��繦��,���n��e^/xԣ�D�a����3�Vg���Ot�X-L�i�J�$������"T���!P����c���k�z��?'Z�R���!;�e[�#7�F���g����=_�T��w#���ND��3�|�jD�S ��|_��Hj���H�3�W�9e�? Ap|\��0��yT�+�y\�K����Q��I+�>��E�I����f�*�K����8�'�u-ن�.������gdRI�r �-�@��x]�4���yb!��k�{�������zS,���(u�8i^V����ɒ�X��']�eUܖ���W���t ���[����Y�p�p�[�"��ڧ�T��%���˳�I�l�-����1g�7,��aw��i�߶g�[�@8T��Z���m����)j�n����/G,�=��[��O� �� O�vׅ���ߧ�ͦã�H�J~C�[P&��1���c�� c(�;/�m�I����d�t�:�a6W��Ῡ�ƣ�ؙ����jz�����\RY�ǍAD��E����"C��W��&��"����E�6�"�֊����͑j�" �E_��F�� � IϬ�=8h��IH�q��-:��9N���<�Pۗq�����P���G-Zژ\)��B�^a��7�QI�i��f¯ ����q�5��b�74k�Svz�X�.c��*'>�B5�]#c��I��y!N:0!#�%Z|0�?#�����p֠J�E�_Ǜ�e!�%��3:K��#�,�W|�yN���{�rw���I� t����yE|�@�������K'�k3��{���o�b�,r����^3� �.*�Z����ɣ���n��<H\:Q������t�hS� V��i�ʅ���0p����8q�>\�p�Q؈z�N�agj�0�#"w�K.�wKW�CZ�+�eO�QDIa�T�'�G:��Ǫ����� f�z�o������r�]��h�G�B�i,[4S��H�?]��j���i����܈��������Ay�̞9z���6����ɟ�픸S�=V�qʳ��p�<��W���������Hm��:�����&oZ��3��o5�rW{Q3��p�0�����+j֤�t�><O B�)h(2���k��?@��9c���׳l�a�d1�=A��Җh~%�fED���!W�/,� ������q>��} ?A^i��������xG�y>C�� M/Z��ݱp#4g,M�y�T���#þ�:������?�͗���T����� )�M��&�e�v'�PK�ɭ_���~�~��i&�_?�� ��� ��Fim��W���%��S�k?xFj�ۥ�'T���_6��^1X�*�����Tqa���q ���ǜ��>sL�ȝ��)� ���0��h��'�̞�_!���Ȅ:k7h��Ws�%Ҵ ��neF�Xx�0vӷ2A����a>Ua�-�U����C�����1٪a�(+����dӦ�n��Wg�8H{�� �����ٲ��h�8���:�d�Ȉ�{,�e; ���|mj���X�ryg��?;"�#n��u���8B�+o�ݻ�Aq�NҮw�ӱ��i���.oxw�\x��2�}���T��x��h�� ��F�}iӅ�I�Ղ�ev;��q���0 ˧�)��Am���{Xyh�5��� �f��UC�촎>�FsN�9E�胞�g�?�ii4���!GS��D�e��PR�EK4�q�lb汿�m��E���ĝU$Y���:Κ|�nv��:��9�1@�A%�������2λӷb�������t9:흜Z�b�y&ڍ�d�[R��K4�����L�2��mo_I�3��*_���JV����<#��_�<��x�`�m;�F#���Vr"�T#��~����ԅo�;�e�4�9�CU�rU��/���������y��x����r��I�H�J�0K�ƹ^l���1����Q.�z5����h�0�@#���a#f�m�Jۦ��]. c>/�B�cB;��0+5F��Հ��)+�M�)�Q7@V剖�\��ͯ�Ix�4��b#n�xL�a (4���\^�#C�6��qS$�"cv�Y��*<�F6m$�T���8��^��ړ)�.em�$ �����_�]��-ML1_l�U���4G��g٢_�jr�l����7�PG>hye�bcv������%��:��KyŐ�ɨ����z�}3S����m(Ow����:�C ��X�E���Z��Q�)���Wo�/�d{π�e��D�P `��}&�� �+~�J��Љ+��I4PM�3���5�A�z.��Qֻ^?L�� %�I�:�KB�5�S��)#��F�^��ETV�%, K�$��Z��D�L�1z���|#r+i��+O���-�Bq����K�g��cW4}�3H��������gԴׄ�s���N��Ą<����>r;�b= ���VE�]�����!@h���Z����A��F����p�.m�2���C
Behavioral task
behavioral1
Sample
OREO-Loader.exe
Resource
win11-20240419-en
General
-
Target
OREO-Loader.exe
-
Size
12.7MB
-
MD5
17d36cd0ebddbfa3cfd945ad41e916c0
-
SHA1
9fe38cacec5f7fd3f97b8ebd05cf7d37bdf02f83
-
SHA256
b017b1aee7ae0f59aa6fad079e88a54987af696724a3526f5a0d4557063d068c
-
SHA512
a3bfae51b5684cc3a5aa8a7f69486c78b47de8c520ffe747147096cab89e6676fa038db4829766f179f43ca08a7616f6a16c61b37772b00130bd004d9a8ae6b6
-
SSDEEP
393216:0andxLC6F3xyNOiSGgCdsJoBZ+a9un98qsh4I:HdBC6lxykiSqsJo7o98b9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OREO-Loader.exe
Files
-
OREO-Loader.exe.exe windows:6 windows x64 arch:x64
19565de09215e09347357995c4ab8f73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
winhttp
WinHttpQueryDataAvailable
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.6MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ