��rJ ��<y�/D����$,� ���tz�U�h����Џ��7��ְ에?%�����#��u׀�H�6��э�7~U�ۻ��AҺV���4u��Fw��eFq,�+�1A̸8z��J��w�[�9� I��9� �0�f��Q�p�=�rb'��!�LV+��V��d�=8�e��v�kJ����:jn:SHJ�2MЉ-ML!��|U��Ò`waCy�4���c�D{���5ڢ+�`�6��8���"�����W]#�ѽ]��H����v;�}��Q�Ocp}CJ��4e&|�i�#-�I��������c�m���TPk�'c������=0�S�?h�N�@��=� _��h�hO���t�,cb?��a��Ο���,����p9\]4[�H%��Ur�ʚ�X{Shu�����N�?h�o!�\�8���o��_�n����=���ޖ|���bgٴ6��'��7�Z\��n��WV��RO*E��<M1�z��得ҝr^�G>8�̏O tٽ�5O�; ��ŗ��[�m���4���� ��0D�������AI�l�/ǣ<J?S����lP�5��۰�C�fG�X.)4E�Z�+LL�Z�)��>0��R���S��P����Z�rN�y�����J���[Q���hz�:!e���GT<0 T!���p�3������7����-���$�]�X��CN�G���j����j��;��� 1�]�]�N �q�hmc�J��V/�#�N� ������f��`�MVH;��X�T_,�8�]���z$Xr��F4� f�0Q'�����x#i]((�sDZZ��/�?���=��ʔ5'T�.�P�O_̂�@�ɮ�Ȗ���[0'4����۰#@}n#�b���g�2IP�bѳ���)��L/4�*7ky�x������ Sw���ԇ����(��|z�u�H���X������ �HqG� �`����+��~��� ���拼K����Jh���ԩ�VB�0�N���Vc�q��n��ǦZZ��;��E.�� ^�0��Ά�v+�A��"�R�eg�8N.�O��m���[Ze��Ӭ�@Dzf���� ]:��y��I�Ko6-yv>Қ��m�9�1�����h6u�F��O^m)�؞c�]5��GY�&CirX��`����z�|(��/�\9���Sr���sY1���`����K��Ţ��%B����J+�-�^��j�K�*#�$o^͂�ӌ.�t7����k�)����%�sO�aPͼ#صB�] ���4�������)BY���uhSh.���ٳ���'�dâ��� �zS.��V�} �Zr˷�u:چ=��堮�c�8Nک�J�\o_<�i(z%�s��$m�i�x�<#�<E�^2�zs�'����O"�b�t����̘正��|��r���4E;Hc^o�^���>w��;�tK�)���5������/>���=�'���Kظ��7��.�AS�r�rH �7+o3��#�}^l�� 7BqxP>��d����F�G�Bg�]�o��a����w��mފJ7h�f�������P1����u�U_7M��Um(k�/`Us��Z@>�� y�M�;"0�����_�ѵ����K����^��?he�?����ۓ�Y�W�U���Q���j���HőgY�k����oÿ=��I=�k��e�t��Lq7�[���� _�,�<���uyDcG��$����F�d0�P߰ �1�d�ۏhO���>�+�z���=�d��r�bB�4�\�-���L�{�Eǭ�-|�Ov�wQ�3����X���ƻ�m�k>�>���)�h���/��1���Iz9���E6lm��3r�l-��QX���9 ����[rв���Wh߳�o���s��� ��w� � �^ �?Z�ǸynL��t0���9�ʜ��� �#��f��; �B �>��e��6��2%Ju�v9�n����|���`���H���#�uʑ9����C���:�/�M�^�!��x(`�ƒ[�g��9�j=a���Q[7l����%����YŌC���s�/�AL�u�*V�����DKu����U�Mᶟ�~*duZ��X@�}��4����ӭ IKs�H��N�QS,��ȯ�n-�Y�o)�L�����[ㅥ����%��[�F˙}���;� +���} ���)m7YwԔ�2>kR�5��`VZ�ѿ��]k��� �X�,�T�����>����(_��{��`I�/L ~�Bp�^�9��(�pl:6J�p'�e7�|��O��-�@z#�Ʒ�����l�"��vdl��^�/_`�*h8�)�+�,m�!�Q�9Q=�`��J6�Ƴl ��hO� ��-�\���s��� �h!z��a��d�Џ���j���5��Qp1���U&�n��QHN=��ʜ���I |dz*�!-r�c"D�#��7�Ҟ_��RDva\���B�6��4$k��a�+E���FR#3]�u��`6�V��o)�7N�w���RB7wM��#;��'�᷽���u���{�Pr)$�y������Y������ ����e���a�|�@��6d�,cz�}�Q�Д;�涑Ƨ���:w2Q��-b,��a��V�\�����[�Gc��tT,�X�2�=����&�TPڟ��y� Al����'Rp��?~Э4=6�R�Rq��4DA����21ޘ�;r��*���w�ފ�N�QR3c+������U_|UV�t)v/�wsC����A���K�kkM�&fs!���;��/��*��,���`%����-Ob�C�_&�yB�r�0M��5f�5�]��<�%�2�k�- �����ɞn����*�fF'a��U�0a�s��U��ө��@���Z��8�p)m����5��ք����ث�Ƿ�J�\�?4j�GM��!���{�O}V��Z�<����g�#mJiz|u� �X}��p�\�B|��2��|5� L�&pd5h���Y�����a�w[v�����,u�Fx�2D�ʈs�@�"����2P�p@K�*��!њ�&F�-�>��L��g9�Rj8l�������`�� ��ʸa���A
Behavioral task
behavioral1
Sample
T866GFQE54.exe
Resource
win10v2004-20240709-en
General
-
Target
T866GFQE54.exe
-
Size
6.2MB
-
MD5
24bb4ab435aa1bbbd370ab30551101e0
-
SHA1
00ba20a8f7e10dbdb8f3aac4f72240c93a7c63e8
-
SHA256
4d1d1427436a3099af71409404ed46ffb37ce054f7f66a7096a54a9feb65799a
-
SHA512
2fa59658c6681db7e9978cb8f643620c703d2d2e946c36bc519cd0a5d5bb461a3d7eb21a3afa880bbc728a5a1209d2376cd13477a482c285f67ae5beead3777d
-
SSDEEP
98304:wwGd6ALlN5TjBXYtMgPocfBIsROoK9eKWfWE3FYJ0pBRl9xLTOPRqfLu7EK:rGd6At/BX+JJfqRJQKWfBSOpvlnvfTD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource T866GFQE54.exe
Files
-
T866GFQE54.exe.exe windows:6 windows x64 arch:x64
3c0546d87b904ac15f5ce3e927985be5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlInitUnicodeString
kernel32
CreateProcessW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
advapi32
LookupAccountNameW
msvcp140
?uncaught_exception@std@@YA_NXZ
userenv
DestroyEnvironmentBlock
shlwapi
PathRemoveFileSpecA
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmEnableBlurBehindWindow
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ws2_32
inet_addr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ