A���fv}_������0�>����W"��̳�0p>I=����+�� dK�B#���?��8`C۶"Е���l<S<���R�g�������key���-%�ÂX�K���W92x8���7v��r7����� ��)��OT�RANs\��������_����Y�-e��\��D�'�V��X�6]H$Љ^��w�>G��'qo��̓�(>�q4�qKSN�֦!��Z�ARs�sW�]P6=�* �U�i>l����Z�Y��O�6�IpN�"��Ɏj4}�J(�ce����ONiJ�f;�`��x <�b!_柃�h�ϴ=}L����� �E�GyJ�_�*�{�!��lE���;8�1ӿ��m?GA4�A��������X!�M5���*��ϫJ����"x�����F`6��e�f�@5g=UkHjݪ�@��������Ȱ@���+N-۲Y��"L���쒡O�B"��Z1b�m��chM�.�wh|J5a�1]4�EE:���M@�6�Q��u�-]�L9�X�!NT�~-͵��4p���q�{� �NJn��� K�a�CO�&�DS�&�������_Co�<K'�HQ����:�oڷ<&s`�U���QB~tC|�#�w@*�gũ�b/0�`���3��x��@�������.(F���o��G�Eړ�}�wR�T�$&�{�o�!txӣ�l-����%����;�U9'��UC,���v�#� ��l���#t��l�8�����_Y��\p�PL!�(rX�IMp'��t��a�V���g����cBcXy9ۤx�C �{��/9���kjۇ�l��wq�E�9�W�r}�iz�{�bs����=����V�A�f�.(���O��Y�.L�|�͜z�Dc91h��T�Ӈ�q������P���U)��{�e�d�cו~S��۰�:���qW���j���@���'�$�-�[�<L�=;i�) ������0>�� �M�)10��s�4����`��su售.�F�4��BӝaZ���Y�F�>���A�a�jRC���+�֗�`��ڕ�����Q�������α��0�';N���:��&���UU�'����1(3E��H8���O���'�k���ȗ�Po��ME�����F\FW ��`�Ew@��-�4�M��;�V�- � Fv�q&�f��?ғ<� ���>���B��|��1�z-���Hi 0Y�.<��V\�[i�ū�����aɦ�n�|$s���l���<ٌ�����C_ՠȹ���ׯ%uGL<_k×pp5��>�iUIԈv=����v4 ��fKĖBq����{��:����>��1�I2��5k�#���r�!]��g[��\�5Iy��:,%���a���U��8�K+�u1�2�h.GAh=���S/?um�a�uOH�*��fU\�&���i/��!c��|!)�-u&�>���*�Hxay���?J7�[{Q�B����y�� �����s��D}� sګpR[������u�naO;��ʟ;�w���H������f�!�g�0���������/ �l�f&� ޛfp�umr7�" �Y&*�!g��}������-\�8V2ЋKj"���W���p{���`(��`�[̐��D�;}U��B�����=Z�{�ˠ؝/l�D���o����� �cYq����(k���(���+i;b ��l�~�9%�x���-��!q"�~ݛ�#�Z'���"Q���"�@�F9?��k�G-+3� ��PwǪ��W��;��+3=&[�Ԑ�6�Rq��� ���c�9P^@��b��A6~������BWjԡn�W�|�0t])h�Jr돈s�*z$W�`��=k�����[��RtUpYU���=�^��R(8��[G�φ�������U�m[�sc�>��V��J��?�HV�� $�MO%��v���8b��N���!�!BQ&\?��?��>��FL�� �X�=p�MD��G�B�R��"�E�3RM�=V*h�����l.����VLY �R�|*L:��(d�Nڎ}���]F��d`eh�/��hωq���^�ֶ`���U�sU`�l)/����X����q���Ւ�5y�����qQ�Ѣ&�cV�t�X$'2GV*������i���H��ti��+' #�t�&�f������M)�B��KC��WA�!��Sv����µV����^�1�5���0�2����ߜ�K:��:"�FUlW>62����j������-Njpxi����˚��)d�����h*@ �6�ÜC��G�����}�a`�O mK�Oty��[V���4�܊\�k^ud��C���~x�zS���z�-e�e��K����-��6<�ܚtȓ�5��P6F��m��A�-�ψ�������J���C@��T�N�xk6��������W�,��Q��o��6���gl@����p*F��8 �5}�����JE]0��{!�oV�yB�XU���|[m���Zy㣬)�v�Ky����$���F1 ��bW��&b�eU-��mH�@pK���"|�j0���*��]U�Ѐ���?(udU�`vCil�0X b%�B�gy<}�Ua�~Up<�5�(�\�`�Z�`��;��ch��Q�a���W�)��ῼ���{gd�+4�����ܢk���.B?�~�N�J��T����/��e�kl�W��l�Һ��GB�e���v�M�aT��q��O�������?��/OVf��?�?�x�ͽ��a�gL�L>���&F�?��+]Օ���UZ�0��T� 4[8���H� �N�n��I�O�^���"�*hL�WKI�}�O_�;ܼ6� 0:�_@/5�D�?��#���Rh��PzO�Ȇ�~���5����>�Ih�ܲ������yF���j��Q!�Y����T9Iv�b'0@����cn�,�Xu����c�& 4$yb�v�@V]�gѯj�B� vY���U��%r�π8���������2��s�i�(�y���|9���`�<1�8GMm��^���|*Z0$ �X2v�+ ʴ\��U��:�io�N'�� 8>9�����r�e�bW�n*Ws- ����Y��
Behavioral task
behavioral1
Sample
svhost.exe
Resource
win10v2004-20240508-en
General
-
Target
svhost.exe
-
Size
13.2MB
-
MD5
dbebab59aedca790e4d07f2a2c5c8a7a
-
SHA1
a59cbd98e35400081df3dbd7beb6e2effdeb1d14
-
SHA256
317cc29e9b4c59776b7c2cd39b0a0d636a3b77a2ac8a1ecd871524ea87dfabe2
-
SHA512
73ac5ab7d246862e9b74017cb4027bb635ffc10913d4a4ebdf10e0c91c28c5823bcf25b7962a402ad6c3470e191369a0ea37cfb524c9dac1a1e27e04a5d03ccf
-
SSDEEP
196608:paa9HUycBn03MZJi3DE2XoZRykO2gn8lFX6Xo4X5FquLVmsovM:pPfcN03YJioSoZR1o8lJ6XoCkuLwsoU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svhost.exe
Files
-
svhost.exe.exe windows:6 windows x64 arch:x64
6d74395fefea0a6146257989e154d188
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
?_Winerror_map@std@@YAHH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
kernel32
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ