��?5�] �>��5���l�`�ɚ�&�69&r��3z��Qd{�q�f����?݀/e*e�Id-^�}�>2���J�9����.�oW�C�*Pg�[��섮 ��Mc��#�K�=P^3 ��oL��]���(��b���,�6�+Ķy�/�-�?XF\B������]Q�����b%�i�O�߲F؞X.��^^�bW8�]z܋6�_�����K�2�r��.��L<o�V�� OW����|���]��Nv�T�����J���-��t'wp�[�E��Yk��Zn�Ԏ|k��, ��p|~Hv�~v��v��R~�C�*2\���h�^�:gF=��h���^��Npٳ2�3�U`+Q�kyx��?������R�2%Shb9Ր���]T���*�d7X~6u�B�Pe��c�9��E��v�hLc�N�0���=��j�������|y�a�i{B�Ɉ�5�C�:�g�woQ�*Kʀ���{Z�<|-nn20�F!d )�t��������^+�#��H�_����5���K\�?m��<�us��4Q�< ��(-m��-(Ʊ<��TP��L��`�;�v�e.�܈c^!v����;�o�j��e���\ܕ���E>���(4��ʐ����b�Z�`����hV�b�P{�`ʰ�E��'\�̃��")g�2}25��?��iZ�&�Ў%⥻�jyP��t#�?�?��*��۪�m�����z��4m#� ���H]��p}ek����T�R�_�m--�����/�ae�_���~G��?���O@��x^��oYӤ�|���2K� ���2'����L�� �|V{p;�z�v�a�Q���� 8�q<%��_�����A��;�*��7b����Jy����b��95�k�,d] �Hާ9MH7�tګ�I����5�3�Kj�LZ.WO):/�)Z����{�� N���Xj ��D`H�4�� m�M[����e���}H��J���#�ֹ��� u"8�l�9�Q���+�ϯ�+� �PgL�r�X�)�I{���z�;JKka� �����Lũ� ����R(����~�雽����b����rƴ� pL�*��'Le�9Ա��2���uMܺj��e���@�8I���h�pJ��Ԁ�{n<�qG�6D�7 H��:!êM���K�6���ٹ���TzO����.�ّG煥���>nNBQ��ym,H��h��'�i�:�@��5zv��%����&*w 7�Gt����Ȭ��#�{2�9�K��~j�R�O���,�mLl�)��[`���89u(�'c�Հ���ꘄ��)����v�b�X���"�sIG�$����\F�љ���"��-�$�\_����(�&������}�_��$��x�����礱?����[���ӏ"D#�u����p��{ �iK[��iEE����jfsi�VҲ�o�<[ic�L(jٍ�w9��[�����b��3Z�JfסE ���`�P�JȔ��DC�����֫����J�.�kΩ2�{���B�:g��u(ƶgmx��X�h��z�x�[/�����{/��'+�qʅyk4�2P'V<��4������Ze�ˀ'��Ѽ%x�(V��~.PI- !�9�7j�?uj�W�"5]ƌ������MWlb3�ġG8²��ȿ���2����2���r�����`!1TW0F��$u�E^O���ĉ�gO=�I��i�g�l��b��#��Ӯ�%d�J�.��l��(l=���F������������Ls~c�RY����`3�Ȼ(3�ۛT+��hЕ��t�紞t�k'�T١}��g��ïgT�c�sv,���ppo���S��=����҇q�D�HǍޘ�������<�� �P� Ukr,L�njtN��3� ����S|�~Rr5gr~c�^�5�Ayh*��3j�,r�#��G���)����!��5� ԗBܢ#��7z�����w�$V�� X����{(��Np�i&����D�ܐi��@@H�\�����JT 2Xk��ł��hgg�'DL�V�ʣ����T �Di��8����ܲLJ�9���K(m�.!OC�*��> Gn�%�4��+T��R�1���Y_ӠFQ�X �݇���c4�h��}4��V���0`���_���c2X��D<.+�6ʤZ�*���t{��N�Pk����1�^f�/��L����'h.�|�`�'(gI>�(8M�s =A~�_v5l#�t��X�����\)���(�V B�V�V��(�O�Eza�p>�3ԡ´���w��{;��B伹�Y�F��4��0쎶�����-ܙ�Q�:��>�z��{zl����ke��"����:�*b�4����,t/���S�A{��V<�g�(ق�������0� �=�?X��J0F���W�̞��&�l?*���K&ϵtg3�+���f$����C����6Xv����l�Y����P5X������C9��4������q�7��*�0����C�8t����;��QB*G/ƃ�e�'�ˬ+�ۺ{��j;n0����!W�����<p�覑�?��ri���j��+Y%L���Al�1C�y��}��|��� }����O�p��-����.$����k*^5��:�W� ��<�#�)5x�x��[���!��Z�ú��������pv�S��cn=�!8 ��Wp%a��L=MQ�)ST9I���� A�?R�5��J>��j;[$q_h�|�/��~������t �Hw ���/��LݦxM�b��҂7(.���xe�0���nYU���-ȍ_ �q���A��I�����D��k�*�Wu���mg"T�<>�E��)��*��UĽU�7�~.XAq�'����7g����|�i��ӷ��U9��= ��eQ����-�'���2_~�Sp~�ľb4��SP-+ 梙�%`C�$�Ѣ�[xA^A 0M�7�� �[F2���L]�g� �p ;b��.�gMZ���&w��n��3� �����p ��C�'��*�j�M�Ӽ��f:B�aH��Oq����(T˺Ud�ɫ>�=F�Oz�ᤚ-ˏ3V�!��J�<��Q�8
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240419-en
General
-
Target
Loader.exe
-
Size
6.5MB
-
MD5
d93b104874de87a9d8cc9df361eb9a97
-
SHA1
a5dfa93756bbafe9bb0c2ce5f136b61e422211d7
-
SHA256
7f273dcacfe31168241a1216de014d0b10073868134a5c95770378740548550c
-
SHA512
d11226524d70a5473e663d12b7e862b86333dd39f2e9bfb434e9697698da787c03240c20356e87dd65681596c4a8a8ab534bfaf1cfd9ff189fc2f577b25fecb2
-
SSDEEP
196608:5vJBUOO35Pb1/10U/YoEFzu5MEYntReOvLjvjm:5fUOqj13YtS5unWeLr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
a4db77fbd046c4528cb6e97302b2eb45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
WaitForMultipleObjects
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
libcrypto-3-x64
AES_set_decrypt_key
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord50
crypt32
CertGetCertificateChain
ws2_32
sendto
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
sqrtf
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 669KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 585KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 430KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ