Â~���9�Q���j��?+��l�\���b�u�����wtL\$�^�5��Щ�h�@W�uE�H�.8B�(�EYE{��XpkJ����d���Ŏ@Q#�uO_�]4ĥ�9"�8�t~�n0G�U�8��ӗ����@2�#��Mim���s�uV�v�} �6�b�gJ&%��C��e�P&�6�"9��5��5�Zf��R�(1����^/�:>>b~mu��+�N�8���]��?��A�%�M�;u���!#�J�%��5�$ f�Vu�d�r �����K�L�������S�x^(�q��*�f���̐Ԫ�췘���������:�O(e���k�o*}���GÃ���v�D.�v�_�dU.eL:b��H�l���d��i�w�S� Ú��J�g�0o CLj�U@ z/~�g�w�=���$Ym�?O̫8�9���K:����l�a�0�O�Z���4��Ϝ!%�?!���s���~��N��*���>o�{Ɯ��~���k{�g;�' t}E]7�'��Iܸv�O��<��/EV�Щ���)f�g%�^ 4]R�֜637C���'&���<�ܲ���ו���йʮ�pH�T{��kv� �0�����q�5&rB����C��_m��ܱ�?��[װ��DC�H'f�xٿ�pU��Z�����J�h��n���~=�m�w+ ���@�8�6�q��c�)�{�߂���84������R�������Z:xR5p�V���G,49�mS�m��e�[ ���0�?u� ��r�m8h��;��za��� M[�b�U�� mW�I���ae�*�/�a����Y��0Q `��+�V��:�40�����]$0q'G_<���g!K�QA�S�����F�J�}B�Ƒ�A�:M$|��x^��)�����t�y��O��#u�����a3�����������䛋�;����.-�:�U� �T����w��y��a�Hj�|>��7��� 2/�L{��9M�3��v{��Yn��t�������AR������q�%���fy��[(�kv�oO�H�!�d�����^??����1�5㋫@��#�7X���Pu�n�|� r�� �2�H�pe���q`V?ƹ���/GMB0�!jՍO�B#Ϻ��� 8SI{�7���nh����'}���ɨ�L�ʖA�۸�%�d�*|y(v�:�T�����3� S=��O���"V����zn����/���ʈ8.J�Jk.Lgc��De�qe6�!�L��5�F�F�#%�U�aA�4��(kW�r�u���� ���v��É�$>>��w����y���/V�"���Vt�F���E�!��%!��%��A��Z? %c?����Ƃ��kv�uɜ_O��Ѵ��π��cD\g�����/$���YO��ۭ~�v�h�fPk�Ư ^-?�Bg�oj�zV��"D)P�[������U�d^7%ϫ�W�3a�C P+9gn�1���S��x^�&��t����B[f�A���{�f����&J�_��x��R_Y�$d��9�a��)�oO̦tM=�\���`�o��.��-@�w��#N�,(=�\���n��������Nnb-��lc�f�>�K(G�W}�Y�m�Ɍ~r!|SP$��*`�X�w�����u,Lu��1�遮����w믩������3�~�OFZQ:�ݿ %1�肁$���[��#�ג2�y�dF��SDO�oU��#����s8}�W���5���j����"j�#C�~v��Fw�����m��31^��eD�z锅��R���$ ��97���O�������@�`��%\.�P\��-������q����f%`�Zp��� &��x?�'����z����C�i�|��ⷳ/�%��zNȃllw������z2U�Z4��`�x�:x ��S��1���������F��IX�ng�,wJ\Iz�*�&v�h^��:�1냠�šC63]ab:U=�1���l�:��Xƀ���U&�T����OK��!Pj��e�nD�P���qUF: �b�����f6g`���S� ҿ�<���X5����co4L��:���(G�՚�<Ӵ�=k"�y�B6�����D%��� �b>�#���@,!�iF�K-��*�����x}����P�Bᠤc�'C�G�����+�g�T�M��ع�KL#�)��`+!$R=7m�u��M6��2����ξ8�7�~���Q��V3;��?�*��}��C���WsV4����>T9Y� ��k��^p�p�7�c��%$�O���5�t&�N6��S�9�� E�|� f������n2�2������6�`d��z�W\v:�w��/�@2Z��m��x�:]���n��֣3[m��<wΥ�}�C�ͯe"TL��-(c��uA�٪4�hG7�O��;P�Ͷ��>W�`� ������Yv/��M�\~�=��l�$���~�A:N�2sz%z�%�"s+��Cv�=���!�UHx=[&��ז�n) ��^�� @�*��8�G��;�ln� >C��B���J�����.�+<���s�.�Q �|L��NW���\�ca��Mrg��T�0V��{F@M���YG���\���k�*xÜ�6ɢ�:�hs��d0� G�l��m�II㗮M��!G�eI��ؐ�)�>[ͿR� <���ܺ�q9����dR�K!%e�t<�LX~(�*6&��Oj��{/'�����ͥƪZ�0���~O,�,��BvH����Uf^%�6��$��T8��S�$� �z5�.�6��A6�,�d�Ch�N#01ސ/�����7!�xll�"���f�ȍ3�\����<��P?��+�'�R�������/2�1/�� ���C���//2<Ss�>?�5��6��`�A���;م��?�S Oy�Xx[O%�J��O��f��v(XD�S���[02Jf��+�\8!4=k�q�J�cF��b����n���wE�7zh*����;�%�Us��Ul$?ŏ.ُ�Vf��P� ���5Ubl���j� @_�W\� ��R�c߄T+?�ӶCr]
Static task
static1
Behavioral task
behavioral1
Sample
u237cgatAh2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
u237cgatAh2.exe
Resource
win10v2004-20240426-en
General
-
Target
u237cgatAh2.exe
-
Size
5.6MB
-
MD5
0e2c1ee8e6bdb339094ec24026a01e20
-
SHA1
449972cb63e21bf25d03ad1e85cf87af97c75a2e
-
SHA256
ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f
-
SHA512
c0a71a9d796802bdf7110c8f69ebdaeb9c968df69b41a8bc1ff52f3a4082f40df93085ec278863acc93763ca11114b4eac5278db136540be0bea67aa93c607c5
-
SSDEEP
98304:6s2vdJmvMwJ2liHiHeCJ+46C2m0B/YMh6FuLChc4n5Gc6jLq:6pdJK/46iHu4525Vh6FuLChRn5l6j2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource u237cgatAh2.exe
Files
-
u237cgatAh2.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ