�m���Q܍�zB�IrFSşǗCG��#=�?�� X����,����ݧ�{�,�dJG���\��{"�`5ؓ�&eyO��1��O��#������e_+I��H��'jf�6-:�Fg�Ejft�!>�(X����x�Q���Z |���H��:b:{b��EL��?:o��U:�eF�Z�lҏ� 2e��Μc�E��w`Bj�0��f@"4yP��w��L%�l��(�0�->�Z��9������k���F��z�Õ(eُ�w�eUZ!���|ٛ�e%S2�8|��l��]ZJ5n��ze�oczK9ye��&9�?��p17>O����X��?t� �Tn�g�,a"nt'xfƂz{6ޖ���o��y����_�c�](��A�+E��5y�L��D�k�P?�?M�B�/M�O8����{��eu�kU���X�+�s�ۜ%A<���`��hv:o�����h|�I��i�R�Ug$�_�+4�.��.3��r��X��L|o�y��ֳS���]�A��W�1��WR�<��R����۩�2�&����w������fP��w��_��Suu�;�{�C�vZճ�� ��G_B^2��G�2�/&� q�K�-n��fx��#�'` �7�6{h� ��b*��JL�(� ��p�Q�C���1�/�Eq�n�K-,�Ue���]Dk� ��+*�_��sZ�м(q[�O�$�z˗�Fzx2�N�����������5B�3�&�VD���0{=<4m����B0��u��/^�oa@����y��WfܳY�0�$z~_8A��F�U���<�ӡ�2Ztژ/%������*�y�R��y^�7�<��2&Fz��s'�P�!���</*���� ��@���v,V��4A�ԑ�����~�|� (�ޚs�kk}��1$�����|>����01&�}���Od��� Ɩ�����m�ݵ���b��ct�c���:>���D9 ,S�+����ןu�����<��5�lϛ����6<�0�gEjS�Z�?-���VZH<��@$֓Œy��3$���C����jV%������y@���������:�r��!�>��X#��W,Z� >h�l|9D_u���n�?�&���hT�z[��ؽ��L�����]/�.�ݿ�����-�}��rL誓��]$��歠�1����t+����uL�b)�ʣ�v,O����E9bC�E;��c��(-w��J�^o^<�{P��`��jF��[��` ��cC���GΫ����j�"{7����+��yE5�Fֻ�y���N,�?���'P�c]ԫV�[��C�G��ֈSWK�D,܁Ǝ�����e����$��?F����#V.b���%$�����Y:��0iwn��:ݻ�U�AIX��arR[����Qo�s���'l� M#�͐|�4Wn:S�q���6�Y��w�'���υr�<�L�-I�8� S���iO�%�0���DC�$kO� ���m�š�Ƣ<S�o)p���\g;�9��|5��7�e��J�m�����at{��Z� +9�BB "�%��1�+nz�nbX]�=b5}�_27V|z����^A�$Yb*��@N���w���l�\%�+M8I�C���m���̴�>�����\�u;�^�sF�{8E��P�'i�عV9�Gj�2��O��JK�TZxc�a1�h_� U%����N��b�s_2&���<&M`�(�����{�y���c`��Jίp*cG�NČ��)n��1ꉃ�;!��L����O��%�˃�<����7}cGJ�o���R묡>YΙ�{!>�$;{"X�S�J�S炱jdac�)��;#�)��D���Q����N�H�:����bp��P�Ӵ����`�;Zr��� ��'��bCw�����Gט��l����F]�tH� s�����x *�����W����64��&��VrtC���3� o���-��P�Բ.ִ�9$.��%-N�e�B�Rr�5�G~y&�X�s��h�-%���EBَ��t�V}_����{�*�_� "&Ă=/�~w�>�ᔰ�� ��_�̢��F߬)?����5��&�Q`���A���>?h��9ލ��J`�/s�À���6ۤ�f�*��ڋ"��c �-�Of�[���jNy���We=}��+�cn��:ƻ��'�CbƫK����r Q��9iٺ�k�� ��>��<�W����t�q\�������~�GP�-E0�Zyݝ�azNQ��)�y�ͼ5C4ϱ��p̬z�M�/|�,�K.�̘��:}`}3�;I3; ;{6;((�G��8����`�IMV_e�H��4J-���ƥ]e�K#ۍL��#)Z�����~��̺^Q;�͍�\]�0�OY\;��m�vTC����W�j:�܉��(5u\�I��'�A��L��E H�jn�:d;3�݁xp1m�P�cA�s6Ւ�e��}�J+n������^e�;�O��h4�����e��o�۱ <இ��:t�����<V����xY��1+�å����y �� ]�0a:w�%d�E2��!���Z�X�i�/��ް�$W+���=Q��=�"ϺV|������0&��q+e�+�&OHec�M�?��� ��s�h�j���Ɂ"��yD�#"�<��y|�2>��3���"|[F��C�ڋ��8T�Ii2���u^�cC ����5�Oy�4�ب7�T�b౫Ho�St�e�tp�����<M�`ʵ%BQ�_q�=���hȽ����#R/����4���;���H� pq�#Į8��0� O��D�\��L����{ባ!} ��q6���l2_����L_<'���]:ؔ��"*A�9fp���lf~�h�0��h�ܣ��Ո��p�36��U�yB��n�H� ����EK�5ɝyr@tG��ō�(�_���� �H�����j)��,��6�ޣ2D"���QTkx��271�Ա�`�� �y6��XZ ��n�����+Zi��^�H�o툡�Χz�no�R�� I۰�\q\��sX���%[�q#��X�gf.BX'/����l�8�
Behavioral task
behavioral1
Sample
nyxplayerbeta.vmp.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
nyxplayerbeta.vmp.exe
Resource
win10v2004-20240802-en
General
-
Target
nyxplayerbeta.vmp.exe
-
Size
6.1MB
-
MD5
2e931ac65f89ea535e25aeee078c700d
-
SHA1
96dfccfebd3bbd245ce4d7713702ea2f8c5791ce
-
SHA256
25c7d5e1d1b73c3a8556752125fcee77323f2c28fd42530fb9dfc76bbec64f93
-
SHA512
ec9431f9ab515f827e7d42a8667922da608e53c924a00a198d3d77e2e5699939a7d4d0c3bccedc92c75f38872ca52293a9f05756b01031a4c7c8f904e7f2ed5c
-
SSDEEP
196608:pGhXwTmgG+dog8KcZJevwopbJMaP9f+xo7xFuc:SXwTEqoxrZJ2M692xodM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nyxplayerbeta.vmp.exe
Files
-
nyxplayerbeta.vmp.exe.exe windows:6 windows x64 arch:x64
a89bdbb5ed415ad3d3ec6aed111c65bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
htons
mswsock
GetAcceptExSockaddrs
wininet
InternetOpenA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
iscntrl
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 389KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ