?:���t�R�Ԍնr�_��k1�,�lF���������- yk&�v@o�KKY�T�d�t��CFY��߯��k�M��cA����m�J9�H�|{@�~�;�h��{��Z2R�n�n^�w��Y*!Dz�k�����#��UW����,$P>ԍ�w�F��o6jd�*rB���x5~�K�ˑ�c'�V].�=�4c���D"^�:/#/�YO��i�e���ڕ��R��e'�dI�/`$P8�7���s��B���z���C:�!q�bF��c�� �����^�c\\ �R:��C䎀e���^���c�{P!셡S0f:/8�A�64H�k=UxJ�]�(M�~U���1�a��yU�ͳd�4x���dyQ-�9�f���cbB�z�3�j���Bt�N��tt�S0����z�6{}M���]�/E��7���Dϳ-Ri�Xo�*F�K�>��GG{҅��B��2�|�/��i�HnЦ�%�`�`wn�P�mm����u��r�����nm�jd�����`���V.ͷ)m���vFQ�A�� �?�m��B�v�0$!�(>}����y���r�GɄ ����Z��^�=����4��I�X�8tx���]���u�prew�Jĉ'!<�;:��Y�Z�iQ�e�iܤWL`�sZ>�ndq����\7�a�t����9d�>d �ȵfߣ���R.z��ʺ�&R�`�>.�[���D�5`A�L$�����SW#���OfP������w't5h��.�9�& +v�o<��T<nA���}� J�U�;9P]����v����1�=ζbD� �A�!�����;Q;25�}����A���f9�����;�Q��q+��x?����W �#f3�H'���2��Av���v����i;�L�����]��PVf�R-�b��q;��a��c�ˀn��W�G�tk���k8��Dk�gU�̫�3㞾�Һd�X����%x��y��-��vF: ���~��5��ia36�m��vT'y����^#=&h!h!�!=�ۃ�����|+[(9�1,7���cH� ��5LD��ڡ��/wK��<7�w�^�I���� ��v"��/u�X�+=��x�t�O�c�|��1�iX�t4��e�d��ب� ���b%��A/�n �8�3L%j7��Eo��b�9����=�xâ��^wey>G�p��&>ԩ��w��kl��������V��f�Y��H��X��Z�"�| �k�L6��l0�쐦gdžB��e�O�!��/�r��:���\?W���7'S�'� ��հ�&P<�X�'����J��gƬN�������A��E��������-� ��$$��,��iy�Z�M��tR�g� ����w�%����lE�&j�`ߴ�3VT t ���Jy߹����HN#e�Y �=������� Oތ1��Q����� ���������P�a��3�=�E��O�o~V��p�O66h���JOս�0Z ���ϹF��8�VX�e�3,e�c��a��?��EFп�lMf\T:څ��j�Dۏ H�N��*T ����(��+{�6�!^�>�A]S�%�Ea�{�sYt'pXSH-�\,�"�T���K�ѩ�v*w��{�9|�1� {[E�LjݪX�ц�����`H�>y>����j�퓥���ޠ~�0�W�;��S+�ƽ�fd����)�x�� ��>3���'$��Pj��=$\�n�R�\h�-P0i[e3Y�B���:*��&;�����:�"~�_Z����>�eb�f�͝���(W����w�;�FL�O��N�� ��ӧ:rh��ݪ�f ^�S�<�< �CJ"�j���Fb�j���+��8� ۇ}j=0�'���^��ʚ��l z����^����*jnϱ�q�l5i��2�fpH�Q~<�j��j�r������$T5+z�ڗ�:g�a uڅ'n���#���;0��y��"a:�bP�Z%0cF6)�Īܼ��6W������ګ�Og���gb�?B��� ��lJ ��B���� ��K�|�����{�ގ�<p8���䦶��h�^�GP1��G�c�7��6��\MZ�9F�� o���\�Ti>�w���'P���<�d��%�^�`=�G�~^�n�`�R�4:JW��i�'zANkeĜ�L��lT��K�P�%��Nk��ȴ�ʼn9�bq�/e�,�W��ֱi�&�^T��/�'w�pʘ�D��@�9�����-�>�/Q����dW]<b�/�`�C�;k1�7��Cx��j}�*�VM: �� c�E����A�z'��3��a&1����H/-� {��ʓ�P�@�O6C`[�~�˓��.�OK���]�Vl僜���BmE ��Ô��Q���&�ܳ+n�Н��`]��q���أ]]!� ����\�8�)#�&$�1*���� �%���a�i�(�����l���I�l��y��~��:�>�L>�)���VTe����E��<��=E��N�� bXTλ7�����S��� E$��D����2����6{��ܟ�Κ��M'�ީ���Xʅқr���ŷ�=�SKz�7q7�?F{��(�&)Wk�p��6��ll�/ڒ��q�C����2?+��ѪLdm��(U�g�]jP�GQ��͐�RkQ��+��^�/��)2J )���X�� ��\K<��c#�7<��%j�T�#,�M�����:�%�B4NI�^PVXUQۃ*�8b;�>���S���5�)l�wŞ�Ԗ��A �`���b�^IE�bA�(=W��R���.�rz�%��# a0�L�FNr��d���4� �T>�ލ#��PN��4������[n��8�@���:��w�>3����'NЍEW�)q�kԊf�Ku�A8 R��y��"�Q,;�7eB/w\�D>=λ}�$X�X����N����*�/����=��m��P>M�b��Ȥ��r��3Gݑ���tR|h-�X|���$��������[p�m��G/C��Rx�B$�j�������i��j�8���x�]�ڴ��K��~�A��]�6��0@(2�W�y��K�Xڒ
Behavioral task
behavioral1
Sample
DepositV2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
DepositV2.exe
Resource
win10v2004-20240802-en
General
-
Target
DepositV2.exe
-
Size
12.4MB
-
MD5
0c4e33cb08dab92dc54ce7c9abe8b14b
-
SHA1
d9b17ebd6164bfe39cb7f680561f6fb5b4dca3f0
-
SHA256
cf82c18019d6821c601f6aa96b81831a00221557e62852ea0f3a84d2df51ef2d
-
SHA512
2c59dfe02137e7c8533d3312365e45386f91133d55845630b7cd89ca98ff5bcacd0f5a178dfdec95f2a3708c9efe116ead6ef9925d83cdcb177a537972195934
-
SSDEEP
196608:Mnp2a0GK88ndhe0vMVJaivFJec1DZ8NmI6h/eh8MgsHNqkb48MV+8b95LQ/:gmGK88dEHwivysss/euMgsHT0fd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DepositV2.exe
Files
-
DepositV2.exe.exe windows:6 windows x64 arch:x64
909bdb41668edde9d7fe303966e99a50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
CreateProcessW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
OpenProcessToken
shell32
ShellExecuteA
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
ntdll
RtlCaptureContext
imm32
ImmGetContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
shlwapi
PathFindFileNameW
rpcrt4
UuidCreate
psapi
GetModuleFileNameExW
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
ws2_32
bind
normaliz
IdnToAscii
crypt32
CertAddCertificateContextToStore
wldap32
ord211
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ