d�:�R�KO��6�O�����u�$�rSf��2�v� ��j�e�.�B��� :\Pӟ�8A���FAÉSZ����{œ���ӹ3�W����-�B�LGg-���G�#s)h�Y��wخ��L X����s~�C�$�L��6)�s$D� 7>d����8�Dվ�bo���fʬ��a�I�)�Ƥy��.������n���!X�m�Űb�i0-w�����hDFI��̯;Fz�͏���Zد��i8e=y�h5;�h�w� {����d;i�ZCO��I�Bjq��敜��o����qk |1_��=:�� ���"$�%� ʗ��hkv �T��A9���A)��Q��6������p��S��+�j"ʥ|<r|�;i]8�� �n���p��=��X�TϪ/��/)�c��G��M)��z�.����^����u8w��w���e�����~�sFz1�o)�}��{�f>Hak�����+I��Z���R��k� �W *슦���0�v�qQAzC�]�"d�C'�r��("*���(��a�Z����¯@��ac��+�q[���>R�d�I)��f�(*.I���5p] }��K喆���%XN�K� �I��,�"�륍m�h�OM4��L�n��v���/���ZxK�W�q�p�<iUM��rD��rtʰA�3�����n&DE����[����Z�n8���M�P<R�K�d����[���Mkoɮ��ޙ~z@���ĉ³���N�>_fߊI��x�|�F���\%-v�<b{m����f��Acs��L�&>�y�7� Ա9�r�� � "��]-�Ϙ�q�_O!n�:4���� ��+��@a�FL'Z�`�ئ���[�tW���]|���kz�' ��_1 3 A�P.��O�)���?�Cfol\��/����yN����]ӫ�K�U���x����n��X�G���k�9�u �a'�����u��r���&y!]�f�����LX�W`a0 ����>��v�%�`�����r�|&g���'I&���8K���?^���c�� ��:���V+���`��-9����{_��1.+Hu�;9��'M��\�i��՞xok�ѣ��ܨ],C��&ķ1f��p5q�v&7�Gݴ��8-�qCb�W�_W�����6$w��S��ê��q_3=������\D �Y�,�A}{�b� n�c���J�i�{�JZ�;@����Ͻe[��",�`?$np%x���X8J�!�KR�����D�I�噋�s�6��5<;�� ��� '9v��O��b����o����d������&���1a�ROH�ɺVBX��>����(����98u�ya��[;��N�<��$��h�}�p�?�4���^w̨����AK`�mԦ���Z�h3de���m����R�~[9�9͉~��HA��>B��p�y�B�3� "L{Iɛ�a�{��+ A'|�u�`�"�'p��S}��k�)\E7n,s�����[q�B�)�� M���b%��<*�m:` �3r���a�g$�z���Ij't� �\��o%u%��1�1��)��}�]Ʀ�%(�����������BY���Y�}H��ldߏ�n4_�k�k�w���C�����G��7�؍�mxڍFJ�MdiU�y�B���gm]<Cu��o:��k��]M�Ө�7�}�k���;��ˣ B�~��e0T��-��f����Q����햯�BCjZ{#=j�9}Ԅ��=��������z 5����x��\ɂ�8���*չY��F�-�M�1�sI�����r�i��N�Ѓ��`B�nJ���m��;�� T: \�-�*%�>�W��=�b0��G�9A8��dm�{}'V��V�X'�K-�j�� n�q㳍A\=B(���!�>r2ǢD��$�?�r7��UEs��s���p���&������z!�4WYtR��́�\欜��˛/�� `t8��T+'���ع1�/��#��MU</�ϩ��r�d��9���,Яf�!8��JB@��iV�5c�����a7�fd���X_�N��)Z���9��/'�Qr�g}5m_L��+k�x/�uP��s��$/����?���\$?UZEd��*�������/�QP�����+o�Z)��X�����Ѵi��X�.d���� �$��f�9�����.�=!���='�d����ZҦ� Z�/��^�;i@͍~��Y�;��&k��B��9B��ljQ���g�HVR��ᕙ�䓴n�F����\*���8n^ܘ�� �����m� !_o�8��A��k��+/8��@��'���,�� jˏ�������Mx͇EEb4��3*k#�S�vm�b�������XU(yu ����sv=���O<�h���3ꌨg�ì�|�{��+,�*<$t�<X"O�#��f^����4bes�Q-I��� �W��Ye����6}�o0-*����_�����fo`��Q6� 7c;�v�vr'^1<>�sĈ�� {����8���;g�s�*�_�C�T�ۤ�Y�i�S<�� ��u��RU�3}�����ӂߖׂy��9����%��R)%n�K��� C"{a��[-R�^\7S��f F���Z) ��P֢�]��P4�ͮˁ���s�&�7�݁�5�,��霜��S��jϨ�xZ<�W����|�B?2��NY|���e�D �u���R�36�- Q�4�y�?˹��Y>��Go�� ڍ����Z�W��k�j��V�Ϫ��"C�5��(��|�ۈ,���ĺR��q�È�Z��f��;Kq·lN�u�L��#� ��=��%����O �s��q&p�!�K��o���l_�v����P��J%���aS�^��;�tE%����ͬ�qVd�С �gk���_����<"�{�o���sy�,�d ��2��93��!]ł�����b�݄V���!�t���w2�bVwѹ5�O[k��鮅%es�����T0�h@��r���A'/�с�Sj��J-�1*5�A�TX��:��ܦý_i��_�U���b�0�O�x��6��FL��xW�!jIB�o/��l�t=�w8<M�"U獓1R��Jt�8|
Behavioral task
behavioral1
Sample
meet_engine.exe
Resource
win10-20240404-en
General
-
Target
meet_engine.exe
-
Size
9.5MB
-
MD5
b88bc185cbcca517ee1e349a1ea510e6
-
SHA1
5404b9cbd57e2f3a885626a26370e9c8a9e62e97
-
SHA256
4e3409d208f9241111792476e4650ccd1864439761f41dab2492b5d360aab4f1
-
SHA512
92cbebcadbb4aef814942b518904f26ed4a9fb35c672fd2d89128d2270ce3ce7da61b6b47b4edef86e6f93d15c694a9be9e6fba50c27311239c57d3541a41e20
-
SSDEEP
196608:WNaxKZEobgvDrHLz54pQp2FfYKawZ1ZI2Gsomf3zCv26N4En5JxQoUBRc8t7e:vxKPgnp4dYKawtomf3v6N4Enl0L8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource meet_engine.exe
Files
-
meet_engine.exe.exe windows:6 windows x64 arch:x64
e654762e74c2c21fe2804e58dd762426
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
shell32
SHGetFolderPathA
d3dx11_43
D3DX11CreateShaderResourceViewFromFileW
imm32
ImmSetCompositionWindow
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
getsockopt
iphlpapi
GetAdaptersInfo
wininet
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 623KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ