�3[���N.�]o!�l��dTa �݇;edIԊ�����6�*2� �������1Դ��DF���hGx<�n$�8�СiGp莸ؠծ0�����B��yΤ�3sr#�[���11DA L ;�li�n&� �,0�#Ͼ�I�V�<�+�V�s�/���:U��Ml���� � E���t����ֺ�\�P��sdBi�f��M?y��^�v�ɆJ���.1��P�\j��SM��M�%�Sg��詨�-��"���p���+b��|��:l��3�H?Ŷ1<�1��%���<y7S(�&��9u�A��I���7��:�'l�<x����7u������!a�r"h��!��ܹ;CC��cͪC+i{u����X�4�ӎ`~adi���.B&C\9xs�'Ղ��IZW�-���/ءs�"��?�9@�[�V��d!u�Q�^�*�1��S��#��@��ɋ��S��J1z���tdS�_329�{& ��,`�2f82qum�/�!@c:�!��蝬LVJ����PL�!Z2N���|��)�<;!Xe�9<�#�A��,��)�<:�ʖ�<Oq�d�Z���~O�J���8��9ʺ�3i�|�[y-����۫$C9 7�V�Q{Ű䭙�o���jv_�e�>���9���-�o�"v��ث�zE�4۱�Q�� ����- S��Cu����Nw�W����6Gd���ēf#�Ƿ������}uB��H���;?Sk�qC����ֻ����'�Jy���,��kK���������P9N|�ђ �%Ik�~=G�Uwz� ��dZCL�rh^r澙U�4���13I�|<[=����C¹��N?6�0}`y��6즉m�JR!T�!�ؚ"�LeE��x`i����BzBϘP���l�O�_�)�W�N�VTV���H�� ��J��"q�j��{���c������-��+쀋>����6IbV\��OG�(̐�f�� }�Y9jj�B�ST>����U��r! צ���7�$�$��a1/��9l|��X��e��d�BÐ�Y]�Q��B4�m���{�`���?,d獴�5�:09��%RU(�B_`���������t%L�tj\K-hĊD�R�ݚ�h��}����:c@���ٕF��F�烇��NGH=z�����AX�=�7{%i�yf ����{����n��D�WE��L=oW�`�]��n [u=�>��Ô�[rdC�鈱4vC��{!�N�Q�@�%ݵA������/�h��R�'��y� z:l��E� ��Et� ������)*�Ϩe�� S�n-��;uKE�Ø���D���2��n�� ��7��\^���j��0n:w]ڀ�5� 䓸 ���8�]l1� D�q�����3���I腭.6��i�6� �'��h��Ral�Xb�^ "Q}�_����cbO�zDi"����Ty�X�<x ��Mv��]��:Q`Y���v�%~��14��Hy��x�X�WX/��R�����ޘ�O�މ>��͆x:�;���1xش� W}9 (��+���D�q�=f�O��6��;Ė),���<L���� ���Oc��������֨9�'��pA~�*�� ?Z٦�Q�`{2Nv�PfZ��E�8���\uXH_��4�<���b(��fv;�ɴ���]�f�qw�a��������q�Q���R���Nߍ!�M2.��T�V��juX~�����u_����� R����������c;x ���Y;s{+��{��ȥp+���)�t�S�cT߳�U~B�#�i���z�ʘ�> �?��7�aL��d��{�N�R�l������$�'D�a9����;�������Dz��J#�"��owK��>�Z�*q?j�� � �7]�����-'�w��l*�a2Go(���p����$^by����¾[`9���)e��o�ޓA���<��eιGbb_z Lp�|4�*WtM�����Z�%��q��*��lI��k��%%q��>M|�8$�h��RFp���y=U8��/�X��QԓkC!'F[j��v��w�ð���#�k�@\�"��{K=�.����U�2��̘��5��Ǖ}���6x�5�_nA \Ю���,�G�B?#�:vW��/�m!�n��"�K�������AD��,J!�����鳹��.ּ�*I�7���;A �Uׂ�tD-�m3�g��)����ͺ^.���3S��,Yl""<��a :z B�\��W����`�!��bV����Z(ۄ%��� �b�q�/(��Iy��aƥ493���͈����/�$KO�4BV�S�a����#ʝ�ɣ�)W���34R����*�D"_���p����я&jSQ�5��&�����H�\�u��Q�98�y/�{L�z*�cv}��m��1��nN�U�5�b.}-^�rr|�}R�۬�U!R��N�G�������C�.�B��I�n)�?�<ÒՈ������B�Qڢ(��C@u+�6i04��F1N���$X L�� 7�]����G��Pe�EwД��ݛv��*�;�5iu'N +Wɵn�GO���b�S�O;��/U\�֬t"[2�wm�cr;�}��݊zb\��D�0)�;��u�,�����V�V����vM���.?0��}�y;���@o$ss��#���~�2��n#����S���+��U���ҾqT��Kyy013%(VP����줣�W�{������u��E��ēx#v�4�O�cGj��Cq�#`�Ʌ�>A��Fg����EQޅ*,nRSt���et �_mlW`At��7i#�̪9��<a���c�O@�v�=�|"�����C Bd�|��#bN/yt{%ѕ�L D����m��.۔+Y��3����+�MrQ����כ)����$]�,�#�<J��#'�_t �U�%����p[����|�,Is�����+����j����V��)!1�LYB�/��/��� 5������H�O({ly�~�����B�>�ڷ��>S>�K���J9ڄ��b�y��DP)|*��ު�bn_�%���u�jP�u��߄uVVm3
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
General
-
Target
Bootstrapper.exe
-
Size
13.2MB
-
MD5
a20c7241b0483b3673b17d42ad9987ea
-
SHA1
45a38459e0dad54433243a45e5b53fdfe48c333a
-
SHA256
0d64d6c344e5278118e4dc6e91036dc2211bae692d36dfd085c47940b42c768e
-
SHA512
2e7131f1f50b15005cee38d5bfcc77a20ad303e45935dc22664f4b49ad8f8ef459331c7089a44b348c4986076367d425c8e9e40aaa04726f39a590ed539af313
-
SSDEEP
393216:S/S0ZYVrwXh0SJamfZ9/2RofvW/sT4iLYCsOZ:ojZYpqWRmfZ4y+/m4ifsOZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Bootstrapper.exe
Files
-
Bootstrapper.exe.exe windows:6 windows x64 arch:x64
d910780e43eb6473c6ca334d8a16a8af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 890KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 682KB
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ