>ɣ���m���8û��wr�l_��ZΎ�x��Rя�,����ଙs�z0P�$��˶�>.0��_��22���K�M�ݿ�W�u��p� ��X���������v�)r��'9 � �������j���?�'^@���tQ��gp}L���}�Ѓ#X-H#q�^�Zw��&��/\���s��ț�v3��e`Bs4&h�VL�`�bZ���Ì[�{�� 1&�kZgU�a�W�'�i� P9�ty^"�, �Y&�4W̻U��3� ����c���UBq�B��2��CY#;���P�88{K�(v/hk ґ<�*ց�Y<��b��s��m��)��q�A9] }� >`�J����p��M�!�Z�;����tTF�Y,�Q��:��V:�6�6�����B��k?̆���HT�������g���'l��Gײ�NN��/�����A1V{}�<yzV��ّ0~W?J-����*���C�p���g3ݛ��3a�������ӤADw{k�n_�&\�/����C�A�N�_e�9}��R悮Ʉ8��/���M����g(�3��tg]��T2n�+���$5�wb�����X���k�Ϲ9?�Sr�Y�Џ� ���"˻?8�����U�[���m��Ů ~8 ��t�����/0�T�l`2!S[R��H���m��y���o�� � _I��}.n��sSx�I�e���>&Nh���T9�>�¿��� Ƚ��d:�u ��_��|t�,^��Nn���h���QA���2*C� C.i�g�L���#桀��N���mn+����K_[Zz�ѷ�����}�d�cx���#�R��M���K��`m!���7��Q�%\M$�tv�Q�ץ���7˳%D��L2��Z��,�ٵ��Ǡ��Tqxr��������Ք����J&C�>\%���2�=I�-����s�+�������ӁB�~^���Z�so2������W1�ڳoF�6�U�x���Kj�ؖ�ٕ��3�1�(c�������ք?���5��ඐ螣�P�A/�`����"ؾZϲ��aQ�Ӛ6�˒ݕs�B�.�>�3�0�����3#0ܤiU�c@��+��W�H��؊�c����� �Nik��$ҙ\�ز�n�F�����H �%y3o��ގ<�1p!��,y��C��3�U?���p�xÐ�@^>�!��ļ���)��A���sU4:lj��� v��mI��a@��B}d5{ih6���T�z ���z�t�4,��9��?*�� �}h:R*)6_��Q��}��Ġ�*u�ܑ=S&"o���X����Ep�Z2����gΜ����Bu��reNmn�lc��������4>� �m��5\Й�DdK�m��b���]Ji�7� �M>��9O�c��s3��(�0�Ŏ���̓ P��Ȓ�B��p|�!����1G�P%{���m�Px���CW�lOm��p�᥀����x*Ѻ�a�͎|i�c��J� �`�"��I'�����qG߲�*��|�Ăr��f~�zn}���j��V��I-�sI�����/Bأp7����L^%�F��+��� �3����P .˧E, �E/�w� ����-�nNMQ9v�0ꏙwo|B�v֦4�F.e���i ��ӭՓ�]��z���L��� �^�ⓞ�O����.=^�NʠL�Ʀz�4�r]QN%�ݓei9�����L���f,�S�,�?��dD��S*�ȴ��0��OL�N��+f��y� �l>����<�i��[=J���H�0��n���Q\ T�f�j̜&��'��J�[�Vw"x.y�8��,Aφ»Fv��@���ב��d�f����k���R����u�U���9�� ��p(]��5� l۔��j閌��lWz���Ipj�����dN�v�����6|bHQ�]r�Yߋ��EJq�`�j\b^���{�O�������h#,�d6�DYU�G�I9^T��;Q��<q?�{wt�_[�g���d����v�W.����š���[0�����Q�۾��}8�vE��>+J� ���p=�7�P,�@ah k ��S\�E<,���7���̛������涗z3Z��R#.���� F�K�� O��D'�z$��7̢��ym�C4h`y���M$�dUP�`@�6���X���CAq��ų�����Aǽ\�a��l%�\��X��c��Je��x�Q^�eߙ`&Ҩ� BGMIuo7��:��x��,z㪢7�"κP2D�h���e�.P$8F�mC[�Ʒ��� �����-hJ��T~*�֏/�QO�k���R�%��� �|A��@1�P�=!h���]�đ��w05��8K�߽�zA�?�(�����̌�Ъ҅E�����$����̂�I)4�,�>o���� �;ubixP��V�r�hW��o:���u2alִI�O��^�Wm�V<+����Q��n��v�ZH#�h�o2]65��Į�f�2��~ ����cb���t�}�}�1N�xKhc]I�OJ���I�'O23Q�f(�$ ߚ��2vu^ڸ�mM�~���[mĪ��p��c���ro�|�AL��h�%�R���(a�43:�KNg����%�n���,Gߥwe�yQTI5��"b�Kx��,��%���,8\0��$b> ��r�4���$���M�� �sQ|tn$��X���0R<W�](u6��p�z�^�YM�gkS������4e��7���x�䠂[X3�� �MP]����v>�ɧu�F�_����<��a˰7�eN�G�ܣU��҇A�TO�{.LuȌ��q�k���,���;��Ǜ�� ��صx<ō����sA�њ�=�S��E0��}"�ظbнj��z�*r�,��vb;�hE��S��d+X��2're���H��%6]o����%��,"�AYe�ڰ)s¢�`��$Yy���.�~��a�*����čP��a�k�푄����N�������y�I�"6�2V������ c����e�#>���ve<f��fnV`�&��C���Ă%�L��Mz�p�!�� ��l��Z�
Behavioral task
behavioral1
Sample
User.exe
Resource
win10v2004-20240508-en
General
-
Target
User.exe
-
Size
5.0MB
-
MD5
4b6fe0a538083a3bba72d2064af9e301
-
SHA1
c2624834f468ab807979faf7760391771f0c4fa2
-
SHA256
9857b18bea72a8c24fccf8eaa369a67b3882de914e9d31705f14d6e5bf2215ff
-
SHA512
b2c6dd176105eb7dd0eeb939fa50eac4ecba0ea91455eb241fd5817223957f598cd7cef22f6ca8b4cc5d4d0558cf2b9039771fb07c5bda49c6b4da5398d0ef90
-
SSDEEP
98304:htEMev0XEBsGBcGdFHVYOV7+7NqTx7Z7CY+LpHZFqewwmNi9RT7SZ7StaDuq:h2Mev2EBsGCQHVYOVqMz+5FqewBNi9Rr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource User.exe
Files
-
User.exe.exe windows:6 windows x64 arch:x64
9d782a27fbb10c4f63dc49448c068752
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleTextAttribute
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
LookupPrivilegeValueA
msvcp140
?_Xbad_alloc@std@@YAXXZ
ws2_32
freeaddrinfo
bcrypt
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
_dtest
api-ms-win-crt-utility-l1-1-0
_byteswap_ulong
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ