�����Os.�OȈ��m�j��� H�0gN*�D�]cΤa�v�g����?댎�7`�T8CE��!7h�bf$��+EDtӪ*/"S�z���+�_ Fe�x��ڝx���p5lx1"�����箸2�`�� �����{w�<�*X�ts5� �C�*�YnvC6쏵�]J�Qv������CFg��i����n�ע1i�Me�)�"���h�tq�ۄ k/)�j���th�<��+d�x�� ��˄��'��O :�M�~�~��-�&Z��w�� F����6u�����t�� !�& �S9�/"\h�,??&���}�º�n���#fmo�������潙����N߶���w��./o���K@����=ys8��Y�Y�� 9O#lr��8�vMg�#*�����ٮ�q���$�02����p��)很c�l���,�Q������<�9�����7�Đ@�M��7�nP<s`�g0d��3X����h%�V+PiL����Q��z���C�F%����q��}+���Y|�ǎ��5��X��זOsn�����]F�y^ é��Vg1���g�O�unp���H�'Q#SE�bfn�O��-"��rz���3]�l�_��6+�#�:-��Y U/0*�<�bx �c�:�Oބ���X:4沕�dor��GLO�� �s�d1�H1[��.���i���!��/`HP���.��E':K��r��߅����ûg�<��BC�~�{�V_Fٙ����~vfI�RZt��a�s�������Hu��mۋ��A���}F4�n8����7�<�`3�3X�יO�91'�b�������i8�uvI�YO��ȧ��L���<Ft�����5��ܡl(�̥�lW[r�F�q�9��A����,^�Ք�~c�L��ZN���W�U�.��]0S*-��4���__�Z��6�-�jr�,x���ښ��-+w��oщ�X�?�����T#l\W��©�Ka�H���h���xS�}A��Y5#���r�Y�L��� ��ñ0��~���m��u���**m:���?��m�9#K�dn�8rb4u��i���f��<���Iր��B^��˥�غ�g�u����� �wș��z,�������?P�9}QZ�����x��?�r�=H>���|/N���61�T3Dn`B��,�1�ou�eΚdt�/�?H�ݸ#��~��zh�p�&�J���(˞g�[�t��>�.-�G~!-]}��E���=D�2U:2�=.S��.َ�kG ����ݼL@�m���\������f��Tұ�H�_s�|aq�w6�v������#�1�doo��h�ȂLd���츼�����g���x�.F������m����{����3l3ш�[~s2�gj�����*�7K?ͤ!N�ǂݲ�*���R��;��&Q� ��ߐBk��7'-�<`���*5!���aÕ���T��[K�w��r��T��� �w ��G?�B��p{�ILgɆT��SU��(�����ݽ��3�2��<T\���%i�Ğp��W�6B��-g���f?�?r��� F�7���٢�������#;v$ �F��шx��� �$��d����G64�_�h!����M��%�����S'^ϩ���r��G��;ِoJU"�Vg�ߵ��e����/i��ALU��7�T�D-����-�hse���Ke� �� ��-0;�\�oY�u ��lw��tG~p)H5V�V2)Y�@���!�h��:� gP1^?&�ΛKY��+ e�;�d��-+�d���2��WNN�r�x�����A�;Z(0uٌ���H����%�Yt3�!�L��k����!1���Ӳh�Sf��rF��O|²�Mo�y��9���{Te��bD*����+�+p���������`K���.4�;���O���=����)�j�&�� ?H ��G(9���W�n�����uF�6��xO�m��a�^1������(ۉNX�&<���u�����<��6Z����[(��� W���Q�I��lP�d���M�n�'��KZ�_ޡ�oA�W��첷?YMl�����2<��%aPY*��� P��o�����oPc�Cj� b�ϔ��|��s%V�Q��G۫�`�JP%��WB1K�1r����<o+o>FL)�rZA�些��w<�^m�����_jh"Y%�h@��I{�L�6��Hd��]�['�3���b�q����q���6̺�5�^��p]mAd]�q��=���u�>�y���դ0��s��&��{���g���Z�r嬞ţ��ۆ�ݼ뫠�!�0����p����N�f�9B�Y^�����,a�#d��~����,��t2���i�����9�]���O�i#y3���U� Z�_�L͂t��6�,8�:��U���0���k�mk��J��/�E�R�Q{W��{�l�zYc�i��^����N�M'�H�����~�8��)Zw��T�8(t�{�7�B?oD;�H��I�>�-QN���7�t��uxYي�Y��6�kNw�G����4c��Y.��ݭB5b�Dod��>�������̨�9*��}�7M) I-����,�V:o@��p����"���] @hYs&h�c�ѳ�"����K���e \x6i�&y��&�i�蘵>c ����,,�gˁ�e��{�\?݃Q��y����K\���:�D��!�)h�]ޫ�b�lz�����U�A���>�如���{5�����L�`?1T���z @�H*�X�}��x{�q��y����c��6o������������^����Ԑ�S�ž�71�����u^�@x�R�^k�����A�{FN�0 �nʛ��cH �YT��=X���g ��qy�������p��{�����c��7 � ��˃� �-_m_�n�N�e!/�}�fjfV��bȈ���3�i �(�<;86i՜�.FQ��/X�� ^�:��?�Z����i� e�;�2� /���-��qX���|Q���V�B���C�U2y�V�{V��
Behavioral task
behavioral1
Sample
tracedh.exe
Resource
win10-20240611-en
General
-
Target
tracedh.exe
-
Size
10.2MB
-
MD5
50910de72fdcd9582628fd4a9b9ace95
-
SHA1
bf393572bb0f81d70e100ff7d6d443f650a848e3
-
SHA256
bff22c92a88586cc41617bde3c5910b8b63a5aa31e343b3de78bfc7767bf261c
-
SHA512
7a3b1262ed88b01f375f0b4bf007100dde07ff11088c2fd08a6562916120859404829a3152d886c4662f44f76c127121e10d24acc55573add11707306af258a5
-
SSDEEP
196608:uMbWScsIhObOhNRx5nPfGH4FvlHjmHkwUjIC8rrOpLA5lcS2XbyhtY:uM3j0O4j7jmEwMzmO9AHcxry
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tracedh.exe
Files
-
tracedh.exe.exe windows:6 windows x64 arch:x64
76f559abfd3e33758301b2064638b807
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalLock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
RegOpenKeyW
shell32
SHGetFolderPathW
msvcp140
_Query_perf_frequency
ntdll
RtlVirtualUnwind
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
powf
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ