2u�_|W��<\ԫ�A.V:8̏���i�N��r�T~�-h�57�q�R�&�j<b6Zr+�T�h�b�w&����HM�LX$�}�c�y��N��f��U]�+|(k��BvDpv!f���.crs��\���'�X�V�JW��NCD������ ��ny���A��FI�Q�)ir���p���hx�Lϗ�^��m�A��%3�b��hՂ��,A���Z�zJf<�/�M���h�j�3���tk�f5>��� <��c����*�q��6�p8����b~9TzX�y�5��y��I�fy�6%�����U�@ �X!����a|Z�z��&��l�O}�Ph����ʘ�'x��a�+�ղ�W��1��m����l�+�U}cD�NS��u�}8�}����[~����c�DC�x�3�G�����Ք[��qMM��E�H�S���P) ��x��{ {�g��|>T��&d�;Hg8��ZuT���\9ߛ���Lb�`\�7�E�t�|�5R��.�Ea��6�q5��2<��DR�����4��sJqG\n�����&$����_[HM�{$�A�օS!=�2�P��+km������G�&G�F>kС���]B��.ZM���J0j��asg��EG�T2�i����(%K�����"N[Yx1U7�A���|p�\�qvC��3�0m��dA|5w��7�!f�Kq/0�\���x7xK���_Kfrk���۳YQ<�#��9[��������k;�T��'r6�.�yr~�j�Ç���et�����K�д�r��[ъ"�n��5�~�2r�$���� ��i���2٦��SbK�ѽ�Ly4�HD� �,�j=�H'�eVЇ�Ǿ|��Ód"�����Ќmu� ��^�<�~��O<����O_lx;����Yl$��~q��_q3x�Ύz� �c7����e%�?�k�,#F���;>n��;&�$�#��w%���a�z��}��7���N!4km;�J|`vbB<v4FC�[f{ז<�gOJZ���Ӯ��ޣ^9�H�֜U�.m0J�z�ߕ�?����cz�]����~���T���ӣdOq���2g�?Inn�^�yzD�����z ����t}!�= �����Q�:Ӗ_[��>��dH�x�-F�.�#�+~z2g���=>���p�2�=�e�����R�ۘ�t��[���|�D�a�0���7�����m� Z��q�S1cp�WQ������J���B���؞��$���6�����6� n(�-y�[��&]4T����*E�S"�g���&�&���lz֛A)��&��.�!}T�%\��r}IQ��[��I֦�Z��'3���9�K���-�T��sfAF(a��9�������#�\IG���u*����||��o9�tO�}yۤ������E�}�R�O�N�e����G��UQ��}�%��k��u�Y_�杪�B3<���v�:�96 ͖�Ơ&�I녥�?��(� �ÅTպ��!\�oj�[͏X~O���Wx�͝���}&���6������p�Ѝz�7'�is�`(�qIŧ���1�B�anmg��1#�����tz:�8�6���~�]n <��l���WWU�&`����l �=Ȁ�u�5�1z�f=��������e��͊�L��r9)�|Oq�U`�$$��~'�5b�B:��^I��5[�J���I �psÔ����,�ėC�)]�,���=�����X�d������c�X�<�w��@�����&&M�z��䛊��Y�vs��`��!�qm�Rޖ��:��` &4���P�i"9 �<�].�*rK�m��"� .<�3=۩��=�;%L�d�.#uǣ��.SI`*`Gn��*M�0�@'�_v-�NY|�������#��6kV8��~'l7���4˟���#g�����3Ո�zL8�lq�L�c6 h }{���&���?�myo\ǵ�a�@Q��iV�����]N[%K� ���Ń��4^ ��n��@�g�1�υ+�|��PܽH/�7[����N��G�6Q�� ��&�`�v�*�������%����E�� C\ł�dE��뚮�E�x[���\���̛3��٤3��qH\�1����R9ٱ*-4OȄЀE~�k_��K���6^������!�W�ҌI�?Q�ٱt-�� ��]3F�Xҥ�CO���o5�?��\���\��[�����y��"�D�3�����P� g�;95X�k4�whN�3�)q��$c�لMM��nxt�E��o�|!�F���C*�ɍ����>�S������R�F(��T��Be�NH/q*��)�a%�}ʁ^�b���4��9M�=�|"�T[����>� ��N�ea߱66�%���#zAX�#u��Ŕ몫�sԠ=C8"1}W=^K���@6 7�׆��wD�v���"�]<_����{_X�҆��\�}mJ��J�G#y�W �UJaL�h��1S��At�=�劣���)��Ǒ��++9eI떦�]���~����� ה�������GT o}��;:߄���_6�� c�k�ٳ#���K.D�ب+Y\a�Y�&�u"��9E`�/B�(�IrteO7�����bT��nꎺ�I��^Q�������b��:x��C��l�!�x�K�Ҫ�Btz�����,j�`��3~��,����%�����=:A�(�~�?�1�A�H�7�Ź����U�Z���}���=���갹��O?��m�>�}�*���� }�'����5K�%��9ٍ��7xD��h^4�l�������*��$Pu{�M�y?~� ��� I�4M�Y�s�� �u:����.��*ed)Q�)jS1�&��7·?��r\�u�6�~XM�"�V��6�$�7�jCo�-���J&80�pb>o���^�W��Xm�y�b8������RSѝ�����N�h�;N�&�i=���-�J���{W��^�B>���������/��!A�,UivR[5�eo�5��~�L�� ���s������s�F�2�����s֥��Sl%�r��$�2) /3�7�qޢ �)F��8˸��K�:�*�V
Static task
static1
Behavioral task
behavioral1
Sample
chrome.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
chrome.exe
Resource
win10v2004-20240802-en
General
-
Target
chrome.exe
-
Size
5.2MB
-
MD5
b14199b7917f2b34868fddb585801474
-
SHA1
a207f61c1affb9fe2cdbc10a97b12278c5632719
-
SHA256
f434bad743194cf3a12ea85a4b81cb92c711a021e3193ed5cc0b18851657fd38
-
SHA512
e80ef20dcebe56b54fe18b460f847132a2d90434e38ccbfc5132e46f440b13f191092549ad747c4f728fd95e8972b1fee2639e1496851ba46dca2a73ba2d2e4e
-
SSDEEP
98304:KAu950EIvLNIAayheiJdsLaJIkMdXq6cFwSXEnPRmheYjF4hWQE69/H4:K+ESLNIAayXJds2jMd5cFwSK7YjF4hWE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource chrome.exe
Files
-
chrome.exe.exe windows:6 windows x64 arch:x64
448dbf39307de301602af11e330d6b74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtQueryInformationProcess
ws2_32
getsockopt
crypt32
CertFreeCertificateChain
advapi32
CryptEncrypt
kernel32
WriteFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
bcrypt
BCryptGenRandom
api-ms-win-core-heap-l1-1-0
HeapCreate
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
api-ms-win-core-memory-l1-1-0
VirtualFree
api-ms-win-core-toolhelp-l1-1-0
Thread32First
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.chrome0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.chrome1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ