����� ��`���~�6I��W v�G�9L�&���D�/^>w ���Eӏ߅��ӎs�u�˓�'i[�)���!�BY���*pM*F-�� *�$�эU9 ��������2�������OCI-�2��\�`� GsS5`���㘠;5`Ѭ3���S\�Mo'|�����'?�O0��&> &o4��h�3U�O�,�u�����ʪdem�9 Rmw8M��-*-���}u���:�2��6�b6[�F�@ro ����E4A(���"�w�YJ�S0+�F[�Uf��K�_̐KRq#-j�,Y������٦��(���r�W���]��&���&��Ga'l����/��0��^l��Е�9:cP¦�F���@�0����1����ڜgRo��9i=��Ҿ�����uɄ�̈́3S��?��ÈT�� 0�����LS�3�T/��(n�_Ӊ����3?bH��q^���zˇ XE&�� u���M�)��j�9ժԸ���E��3�|��<��1'���*�}���_�V@��6�pjJ[tn���p��G��xΩ��t�(+W�g}'�R�'YnU|���,��V�"�&��\I5}�t\��%�� x�E�֞t����� .��6���r�����?z]�hѴ=9о�GMt�h�����xɁvd������M������?~A�"8pB��K�7(���x��-��@���09s:h�3Y��e,lW���71�Kv��`(� ���0v���z,�.V}t��i�*u�Pt�]�*8������d�<�(�FQs��jw�W�7�It��"$z�6T�gQ���$|[ᛡQ�v��i,����>Ȅ�:I6ص�+�[��2�䉡�]!-��m�;�Yc��W�S�IQ�>8�Y���>?z��Z��ԯ]4y/�j0NM��hq���ݑ4鰕-`E�Ǎ��S��#ڻ�7�ֵG��.Pߡ�[g��=ΟY0��T�R���G��������[���L#�?8��u�����\��F>�{}.n��37$��f�^��@�24S�4 Y+��m����@kM�����n���0W�*+ܺӂ$����<z�ueG�Ծ�M��; 6A�!��.D�F �]]A�]Ua���P�܂��|)��tPȹ�v����F��C�=-�(wyRj�/�k���'�譚�=<�3�-�%է"b�b+nI2k5� ��A3���!�F*X�"�x�g*x1-9��l��<����!�nlmU&�#r?Y� Om{�kX�@��!���I��8Sև`���vf���i>d�����T�O3vҥ��G��ʯ/�s�G�+w�2p�F4 klڙb��ՔKa���ubN����O{��3�_��0��ex�?ƶ�"c��s���A��^;y�s���o�j��x`�uA�=��kӾ�Tz$@��5��̇�v�Y�ƜΉa��5��V��ClM��9��=��~銺o��X��� �Ȑ�V�A�J}�Ѵ�]t���^�G4\g:l`< ��s[db`�� ���]pFtPk�y�2�AvXO�A�4W?��ov��������7@c��6����;�_%�����mc�-m����:\^���9i�ҕ�Z� !��Z dæ-ի!�_k�D�U�eI��Z������X��Y^F�<8H\�zC�I��O��L4�R6� ���8Zj�:q�=���`���0�Y���}�W�/е?�&<U`;{�ݚ��.u������H>&�C�b����7�8ͫ!�H��*5p�ֽ�-/��ܰ��������%�-����N%��=�`۔nv�*�į���J)���Dp}��ϛ��gJ��5��@HH~���9�0>����V�����Ƶ&4��M'����B+�_�G�J�0$pG��|r֩aL�$�K#L-� �<n�3��k��S��D+:��)��_S`�)f����sVU�Hщ%��F=,���2�%�� S�}�sSV�i������%�/t�1�e��G0�!H����'�+�#���]��r�=ρq1�F�e� w�w ��l֞����Q��� �d}1�$on����$+���$C�L�љC��|*R��/䙺�����.�ջ,�t=P��'mR�� ���#2��3�������C�b"�A_ϙ�gE�FroM�=K��ڟ��ݢg��fK�z<�ݎ67\��vuc��1�R�k���`,��Ԋc*�(<�P����an$Qq�nz(��G�����P�P�9^���.��p)! ��,)�����F����;lcV��U:_����{ Qo�n�7/ڻQ ܉���w/��d�#�N��x���BP��'�[�� \�|��P.���L7Ʃ�2���tR^T�yu���Z�>��l�.�4d9�r��s�0|�7M��$�I[�D�${{@r.E��6��j�|6�� $�pVCzԄ��{ȝ��C���C���z����ގ��ϱ7�PAS��spjiQ�6���Q�! ,���|�:��J��2�N+ER��j��8��>^b���T�@䆱�A�>D�.0�=+� y�)0�+������L�v�H�������CY�1��f��`2'������<9I#R/)�}r>�d�#�8���jݚ%wR &���js"0�`��÷Y��rl���]Et�k�Sd���k�}/Jy(?A�f7�� 7�_�ƪy�dpq�ZɖlڊeS��@uF_ �E��~G���"��sH��w>XG�������/��˞�cz��2�+��vd@��WGS����,�R}(�[�`,)v���������UN"�ֵ���-�QS��A�2f?��cG��M�3~�;X4�Np+Z��6/��{kLuəU�o������,K� #��tH��BO��8�����DzES�c[��Dy �l҃�Ql`�2�L�JYށbw�-����į\z'vo�?�6r�,�\�N�,iQ"$S'Hn �s�$J�����^�0����;���±>�eq-;���v��� �5�*��QMj��N��x�|~;4�%���x�����)����95f��&�z;P��s�[���}�_�������vu� L���_���v���=�L���(�"
Behavioral task
behavioral1
Sample
Elio x Guardians.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Elio x Guardians.exe
Resource
win10v2004-20240226-en
General
-
Target
Elio x Guardians.exe
-
Size
5.9MB
-
MD5
631f0ac93c9564bd1ab2599f8d6a820f
-
SHA1
89da7ce58048fc9c8353b1e9074f09179707c9a1
-
SHA256
6c14276da9f1dd9144c6b82238f8099ab8e28eb678a10a4f77b95c4b901cddb5
-
SHA512
f06e311b12de0d44713d4eb45853a77e6fba55896619d63a9bb549bae2438a9f5ebc55f29a5925fec3246563accb7b41a7d928a19ced9326f9f0f0292f2f6685
-
SSDEEP
98304:Hs5thuUs0Aihyu8ipT24rAvDR3248hLIkqCCMZTQwo0mtQ1P1La:HIVAihtpzrYOLIkqrMe10uQr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Elio x Guardians.exe
Files
-
Elio x Guardians.exe.exe windows:6 windows x64 arch:x64
37d4d8a6aebc40073dcab6c3428c5d6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
FindFirstFileW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassExW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AddAccessAllowedAce
shell32
ShellExecuteA
ole32
CoCreateInstance
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
userenv
UnloadUserProfile
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
crypt32
CertAddCertificateContextToStore
urlmon
URLDownloadToFileA
winmm
sndPlaySoundA
ntdll
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord46
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
roundf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 433KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ