�s'�C̺|U���E c����A1ɛ����g��gYN�7�0�F�e�kiD�4h~�Cɕ�_�������?r�#u� �@ޱ��V,Yχ��Gn�DхQ}������N�������ﷻ��>���WS�b�P[�=]��@�nm���)�M`n� ?��c�\��<ɟ���M�i+&Kʟ�i��.*Vq���m�룎a�����Ó"�=`NЯT3M����0� ���پz�6�hq�3=�d����iH�2P&����J4��ؙ*�U�P��A�Z*6-�Lx:7������T��w�>|�@D�|����F(�o���bC��g*��o�q=a�3)��s�E���֔N�E��i�P��E՜4�m�!"Z�)ų�T�k��&��aH��'�s���Bz��ݽ1䑐�ȗ%֠�M��)�t����/�v�"%5p�������.ˇB����;��st���N��[��|�����=�~�dX��=Tڠ* ȯ� xGt���!:�#���y��̚���J, �9�D���dۂ �$��.�.���4��l���<�H�K��Ȕ�MI��k;¸�4^������loܽ�se~�B�DH0�`ӈ�I,�S_�Ď�O.������R��'�B(u�Xr�����t�v���F1������s�o�� 7^�B�>:M�g&p���{ia~���@��c*g]5�-V��)�%�H��0k~�o�-9^/�t�jWZ�O��sd��O��v7�?��a������I���+��Ur> �)�l��(J�q���K�� L�f$uU$k:�71�"L!g\����J� �����;���~��x߮κ~�,�3�L�� `L���П�0o��0�},�*�\�9�y�ǹ2�$�A�@�����j��n��9#^K>���1�Y�G�����gE�����.��?y%g���cе� v������~��!ʟ{:�eY�f�Ś�Y]��.�(ƙ<CR��153!co"U��f�2�c���n�j��m�kOC$����Z��ɷW�;Y<d�A�gU2������ eA�� @���bGq�T�C����� �V�j�E��%�ʘ#�ٛ�0mZ�Ιr0���w���&=��φ�,h��1��G@ �=����K��gCj�GL��I�K�^vޏz����b�n�''�Z��W.Y�^ds��Ԗ��y��i[�+�4�v������ #��41�����V��� _�<���6^��ɭ^2��u��ZU�+�#�@�fT���lzфBѥ��:�r�@!��5�4D��������O�q8K�!Ё��wYe�=���7:�od�Vd� ZX��>Y���r6�d�_U�\p�.�a�7�Iș:��|�Ց������څ'z����3�y�F���0ڹ��y&�d��GM�J������ �;�)�܆��>ǐ��s��%������F}���Bq0�H�nh�^q�Wz�Pt� ���:����{j7'�N���+g9lµ�����'���K4hQq|_�Hm�-l;�������ҕH�?�L���f�ߡ�H��!x]�_)�.AJz��UV �S�9dS��FI���l�Δ��~���68t^Θ7�x4x,�H�8��cz�vG�ZOv���k9�` >uK$f������3B¾p앳u抚�0�>O����^��Tj#v��"ٸ6('����O�q���2Q4<���q�˹�F�ʁb|a <:��]� �1�\$���u�?���o6��_SV1�z~hVi�z�XAw�k��w�?<zc<�M`c�'�㘣�b���/y�Pl���@��2I���~ﱛ9��e)4d� d���M5��_�-���CɼR��6��V�ǎ�O�r(�U,�xw�|����a8�h� <}yCI����lWm�3Ðh8̶���lZ����=�K[�)(3�] ���5Si�&��;������O飊q�S%3�*�Ɋ�6+"L.�� �W7ѩfhi����)���.�F��W@��Q!#����gqV��|�>�9ȝ��\w�|\�g����<!�(��u�n�%�Նl�V(��2"j�o�j)\3�*��*=HU�`D�㧳�gɤ����ӈB�����&���ea9l���-��?��SnL�Ƭm{�k��O�\�����Fr�Yh�����5�����t��`��#�:FC��4���T����&�[-�9VQ��krzT�U�B��?��hU×Ѝ�ңL�a;�b���T@!�.'��ް7���C|�L���p�Bށ{����4�ݳm���;�e��X��0--�Xd��3�f���x"R�bFɦ��gq/"+�r�X�"�����1l4_�7�xT��Fj$ά�����)�&}���m�m���j�;Ɉ�ʸrT�����\���N��*Ȩ���P=M%����� ���!��'�~�N.�����k�"7qO�s�<N��M��W%"�}�+h�@���� ��W�zvTBR���S��*����'ڡ,��<%�8�"|�Vb=r�A�Y��t$����,`������;�;~[2���*]�^3hs��OB�^���H��B��� *�X�s'q 47��EAw���W�"~���Y�t�5�t?��Ʀ��||��H7`%��V���DnIXw~�L��#���{Bn�h���"e �J>X��0qK� r��ݷ+���efIk�z���j-� N��"�� 8�����SDd:�g0�g�� j��nmg�2]����O_����(��R�0�x��_IX�����8UX������iuh�2�2Z=Y�c�U~��:�C�v0�L��< ���uLpCY����q5"c8%M�6�!�dZu�;Y:Ƀh��!BO�5���pvAr���Jj��/"���PD� �־8@t�X<�/a�p�E���Tj �3˖7l�?����T�Q�p�^��y!l���=���xL�v�R���Z�k��k�E��6nȭ�7�>`$��r �_��w��Ӷ����R�sM�V�����o���1� 3�Y5������&����b���c��r$(�� � c��F�1����<p�)�
Static task
static1
Behavioral task
behavioral1
Sample
rmpg_myau (1).exe
Resource
win10-20240404-en
General
-
Target
rmpg_myau (1).exe
-
Size
1.7MB
-
MD5
d1f546868502a147feaadb25e7c691c4
-
SHA1
ac6ae44123ed441c26d3d29dc334d9b9a0bc60c5
-
SHA256
d17a30ad362676dc0242de68d4107f9d5b7158a2d63039739e0f456da904043c
-
SHA512
2ca63c4ab83731db4492e1ff3916ac4d387553486e3b76e79ef3e23005e5bd2893b172fe12302b9ea312f15d0e042e2bf03a4a7b6923cd302b08bfec8fdfe82d
-
SSDEEP
49152:uBwrjbvDVom3it3gEBodCuh9MLKgmjFuR9:rnvDVomS5gcoP91gmwP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rmpg_myau (1).exe
Files
-
rmpg_myau (1).exe.exe windows:6 windows x86 arch:x86
646f94ee4dca916d90d9bf587bffe13e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Module32NextW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowLongW
CharUpperBuffW
advapi32
CreateProcessAsUserW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SysFreeString
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
ws2_32
WSAGetLastError
wtsapi32
WTSQueryUserToken
WTSSendMessageW
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
mbstowcs
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xdata1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ