L=��r5������2���$ɖT��=����C4�E&:cL�̄��iѥ)��,��Jn��s��.�Ɂ���U �e��p�6/�a���Q�{)g���R$<+vS�N���ʓ���~�2�Wj�(�}���)%���,���w9���u/�r����� A����ۊ�_�,*�Z����p�����O�M�+|yE�0}6͓m��e���LH�v@B���>hu�/�~拌]۞6�{��qk��M�p�^��������__kb�.�PI�韆�~��Aܓ�uA)��K^b�LU[��D�I��h�c�F��hCز4��&�;EY���"n���o 㠍W�Kћl\u�RDăn�-'{�e^��^�}~> 3��ҎH��Y1��ƜuS�k����E֓�kg�Ҥ1>|����h�lZ3I@ ��$'��:3�>���) ���U�*5]/*;Ub�V�~����B8 JȨT� ��xb]g"ў�}I�_X�Se�8����Fy*��:+�2w4ZB7b`��ȠдX��횹 fxa����" �)0�͘��[g� P�� �z�ݠ��`m��11���`���ݺ\~$ꜳ���?�v(�A�8�� �����]���,�%$3�W#�68��T�n�-�ې�ٶ�.����!rga�Jh��`�d#�q����IJ� y)�[f�8�/�V�I-�-D.[nK��i��ʫ���CH&����R�*ʩ���I0���F@^8���B��C˲�8 Re�� �4 ���o[��PIħt>Ff�IcDhs�G��YeW��*��=�L `�?��[���� d��UN�f+d��%�$YxO i���p�4\4�l��]>u/f�=*�&В�U6}�<?�r�tGL1�Tk��> �-�5"�/X��\������ ۜM[���8�`q�4U_��m\��1Bu|��;��i�C6f�w;�Q�����7������������;(����a���.Xk`�>r��wI��ġ��h�!�JR��_a��$Scܲ�D�����d3��e��������(��.(Z�$^L�m�]�~�(I��tCm� �D���_|� �Λޕ���xډ�:&~����AR�ߜ�g�~c�l�b��M}w��$NA�(���!&+�2��������Yx���/s��"3Hm�ȡ���[��P��yO���6��)�v����u�����+�y�\ό�6·�37G�C3{�>�H������d�(����`��R� Q�Y��izww�P�yp������,к�ܣ�wH��"] �r�$�'��d�)/m��sJ�'v��� �F�j�����{GS椾��S��Dz��IL��x�aw^�O�l�;+.&=�M�F�K�:�YG�V`�NĔ^H���}#vV[ȪfE�F����~����P��A����c�V�x�My��= �$���)X��L�~O�Us�������~$m����ɑ��C�+��B,Ȏ�-��.�sM�]��Ѓ6�"�X�H��'B͵-����S��N����[������Ϋ�I%�*LP~!O�mu;�����ke&�4��Yz�^����Ro�i�.dK�*�S��U��&�U3��8�&��)�����,�_�"�ƤI���u��|��A�#����������$�(���U�w�X�Aa�7���rݮS}e�Ժ/깶�"�>����٦���(���U���@�V����a���,՚����P;�,=]�8,�q�\��Buv�ɤ�8��z�f�63*c�U��K�Ci&}ˠ���~�-��v=- 7<+<��F� j`�g�?�������hehZ "o�F5��c��7P����]���%rX}�(�.��[�R�.wp}j�y�|�y��:�IS~I��)�"�F����rx0"��!��y�#;���IY����^qopaf���vH:a^'<>^¬��u%�A�����_���D���7D���%�3������F_P��S[5�f�ۏ�Ɉn��E��m�5��B���7Py�ßS�l�'�K���>(���[^��!7;�H�z]5���kTW�����̍��s3e#������]�13������.π��� ـ� BI~���N[Hϒ3������QZ\a/�p1�c��Ĝ�Z#w�N�;E'����>����,��r�kc�}r^Լo�R����\�o~�k?��h�a����l�ϰ�1j!�4�w_�+G6&T��u���.�kZ��n���E�_��-���8T���9�cAD�j��� �bKw�}I�,�v��)ep},;��R27L-G;q��׆��"��s>�58ء=RSbЉ]�Ģ��AP8�7@�:�!_�|�'\� gP����yU7L��3W�����^�ڴ�x�Xz5 Y-�RV��+�[T����,&�>.��p��Ct��c7�y�C;��r?6l���ī��DJ�`N�|�� M�fV��}s-�V��V.����Z6��ͼ*��x�HK!��!���C�`�����?e��qЌ�!�� ���+�h�`t�fz 4�k��ѣUZ�)�6P��Wǣs�����mW�K�$�V��I��])`�Eˤ�/��J�Լ��m`�0�~Tϋ��wF��}3�݀@�*���e�\~�,���ѣ$��r@�N��u�K����~&s,%c.1nRE~���O��˪9�"���JbR�V�Y�2\`~�HS阨�?����Y�O�*v}pg a� ���E�e����2�Nj���DL$0��G&E��Q'����6����*����Xd�b�IۖMl��̶!2x���K Z�$�2�{X���[��bn�/���1-U�V��O4����B�LV9������FE�z���_(e�]ƌė���`ߑ����_�s'�{��]:�S�;4���E�C��OpJk�ޟj=\ب5w���_�� �� i�B��FVJbl�'��H)#�����(�#��T��%�b�/*Ed�ը��x��/%u� ��@�jY0a u����pL9K�����Md���^���=(Kns3�l�֩_d��e˗�?�r(�8�> | g��
Behavioral task
behavioral1
Sample
Batcc_Temp.exe
Resource
win7-20240419-en
General
-
Target
Batcc_Temp.exe
-
Size
7.0MB
-
MD5
c9f28ca092bfebce625a57f3df5a2bc2
-
SHA1
3cc90f86bd5eb851eb04ba17a9f122e299c7d455
-
SHA256
3e74da4fbb1fe4cce86465d765956492c242952232126434d03b8483c79479b5
-
SHA512
c6c433c004166b24e7c5cf9d2e03a13efb3378b5114e589390d4797d6856433d988ebd752ae5f383b76125da0f08125c6cf9522c824dd244c532c6325a74e880
-
SSDEEP
98304:p/ZlGC/y1gm6wTtCgPVZ1+eJlFWOQNVEtsLhhTwl2+N8p9+X:pRAC/yuxUBPVZ1blFMVEtsLhhTN+2j+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Batcc_Temp.exe
Files
-
Batcc_Temp.exe.exe windows:6 windows x64 arch:x64
172702053a7e0bd5ef378b8b01008993
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
ole32
CoUninitialize
oleaut32
SysAllocString
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord27
crypt32
CertFreeCertificateChain
ws2_32
getsockname
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 959KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ