�*�B�_4؍�mm}�*2g!p�DE��2`{: �����i����ފ���(��Ɖ�5D��95V�����y�<���` Ɉv�� ��n+�RxB��B|ֳ�i�� s~G�PV���1ٳ��.P'Ƞ��_��9��b`���v"=�X_v#�5�ɏ7`"s!CAڷ����m?J=�����b�z����3��y|)��ɱ�C�3w��4���Jߧ�L����Eb� ��q=wKB�2ә��ݏ��y��]> z���d: Q�4�lw��j�40�r4�*/W)���c�����q�VR�X[���(�2�:k?W80ryF���*EvRR,�(�K���_T�jlS)����7'!a�k�ڽ��{jw��A�[��|"���-o��p��eY�����V����݄J��v4�,����L���A�S.Ӷ�כ��[������Z��A���Q����3&Z��:�%�� �<�͝�R��㢰��}6��M ��\�2�Е���a�7����O�-V� �8����8�*R��U��Gg?\z�K�OTo\�x�r�n�<M��t�M"�p���sܕ��-�NG�'�RIS���!�A�J�P���5��?O���3��T8�,,4c2�4�%|�:z����0I��4PM�M�Ciuh>����t�m��])���Ԗ9��T�'��^ߧ����Y>ڬb�F���X4�䯄q{}d�}����܍�##}���\��P�����D�Y��s��{�T� ��������.tZJZA��N��&l�_:�߅�15�@���Ӟ��}+�X�!0����T�x N?x �֦W�^���MU� e҇��w�� �!�ʁ��-���q�3�~j6��> 9$\4@�)�S"��� �M|L�0Q���άZ��2� H����y���� �r t�J���bU����wV4�c'��� ���+�ޑ��Qd�`�⍕8^8��;�T�-��0\il�_��4E�:- Gn��B�������,6.8Z5 p��*7?ϼ�{�{�w2I�1����{��O. �,�=�_�fd��Nxw�EOɻ �s����f79[��/(\Ѫ`�HI�B~ϩ��L�rl�%J؞�=07P����������]�����H�+Kz���|�aES�wA�L����'[����,M� "��-�� p/2D�2�V�xG*i;,�c!bI��S/� ����ǩ~UE�5�Nj�Es�E�V�QA ���G�aa�Q�ŨÖ�H�P����HE"�j*�mY��\��>-����s�����*,g?k�<h�0V.�C1����Pv��� ����ºw����&j��/�Ɂ�+W�sPv�<6�tw��Z�}��Y�����d��Z�c��0������� �Eaޠ��~Щ)j ��ʛ� ��v�No͗ʄ=��e5��kn������(̌��qp�W�� 9�7T�h��;ON�֠��� XRH��?�&�q��H36�e���W�;�Cx��%v�;O#���[��S��"�U�-�s#@j�b6[�8n�Q?+Q��>�d�Β�� ��������'�).<���N���6���،S�Y3%���wc3CpPdh�;��� J���j�y��^^#�T�#S�e��X������7P� si����%��8=9c�4d跨��,�����~� �1�����o[�Q'�ّ������បux���Ҟ/l/i+���o7vq��`)�2�r2�g5��l��g;q0����tS��(HQQ���y�4jg���q�����i������8K"���s<�|�d{���%X�p*M���r��`�W�:ml���Da4A���k�����@q�����)\�Rl�cBdb* ��B�i�XK���䭍�S ��JF����{m��)���g�eIǜ�"�b^���j�5�S��T!s�)�������x�]jZ&dx|fᨵN���J^�CUȨ��� ��<4v�{�o%? ��U7s��(��g�祝��BFti\�L4��Nl�[�n �:��$���rmW�Հ0��X���&.��n�70B7B���>�p�������S�>��mV�V����WL�/������=�[s+�'FN�����Ny���p]�_�d��z��P΅�_�]�g����P)�]�u��4}�;��V%�� q5�m�$<�����8���kƢН���������$}�H��K��?(*��n�i~u:7�Q7�X��}.p�3�dk����qd�s4���G��bb�#��B�W�ܼV�<�T�f�t.��2Q$:�K�)�@���� �Lƹ�of�zK���j���-�1��9K�}��4!W|�yŭ�+p|a3�zBB�P�V�R;��bH���*N|&Ԯ��S_�K �'35I�hRυ�}�BO����r̍ƞ��q��i@��z���������e{H�(��$�� .�e��@��SX��##oC��(��)���)~y��^�Pm��t���������+�u<��/��� �������E��i�,�'�5����\��� z�L�\���YW�������g��#�`�X3~����c��*S��؍��s��{�e�Dn(�.5������O��C e�/X�z���a̟J���,�Q���f}��u�`�ɴ�����&I���k6�!�����]V����<S�[���\���}Xkv��j� ]�ALF��n��N��J�&���f ����%e!����л�u#6��)�c4��_�ʁ��ek^k�ȌB`��!9Am���˫L6�j��U���a���6�<V� =����B�J��>˭n$�:4G4�)�]���d��O*��.���k�vH}+�AJ���K`o3RG�f�~�2�s0�aD�T���^n4�¢���x� �� A!��4��!�٧����а����D�uzT7 �� (|ɑ��R@�^Zy�3\ �&��=�C��w$E�/�VKJ��<e��r�$��k�N��A6��ji�S�sV�����UP
Behavioral task
behavioral1
Sample
MRPWPPKMOW.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MRPWPPKMOW.exe
Resource
win10v2004-20240709-en
General
-
Target
MRPWPPKMOW.exe
-
Size
6.1MB
-
MD5
18a2cbdb9e89087bd594ae5a368293ee
-
SHA1
d90a7844d2462887227c1ca16aa83dbb7f2462ef
-
SHA256
9c116be6e64462c1cd94eb9c6dc62b82e7735695ea84d8cfdebaa537fbdeb5af
-
SHA512
5b59853a10183e22794fdef5afe7d68b1d232bc0c2736707d09e0221e05e3d6a3ef8318d49617ea85c8230ea8a0bb6440d2b3fb9dd831b7867ae6536bb977d89
-
SSDEEP
98304:Kp9mfVUegYLPO+7IeEKbyrzbUxMuyWMQFMhZ3hJXD1G6Q/q12RC1/J6KYM70EQOZ:KjSqegIPO+75E+yrzbqGWXcZRJRGuau
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MRPWPPKMOW.exe
Files
-
MRPWPPKMOW.exe.exe windows:6 windows x64 arch:x64
3346e2dd454410a9e6dfc0adb5f75a16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
closesocket
advapi32
ConvertSidToStringSidA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ