8"Y%�6�r> k���4FO����P�N�����C�u ��Y��H?�p�{.z��� �'�+j]n��|NW�k������Lu��|�n��$k62_��D�F�������0�ڋWsɗ�u���\�}����Cɻ;�jP���5�~� x�R�cbכ!�j�$��*�-1�z�MG|��ǰ�P?4�SF�%�B��1�\�V�פU��-�/KՍYm�ڟۃX(�NBh�a�'_�Rt�s��'�� ������f���LN��������bc����}Hm����#_nO��>��J�O���o�����z $<�Rz��J�h��.��y���B�(3W f� ��L��P߲����k����~/x_��m�jɄѣ+O�J�8w���Vݛ�ü�{,&L����y�Y����sT(Pխp�@�Y#+`&m�s'��?h�vi0��֙��[���p��<�>���5�r��E/>�y�p\Cdž�v�ꋑ�Hn J#�%��u6}�`�aw�"6��H$�"�yU�=a{��� ܹ<PD5߷���+�}ܱ��3#y��FT�8��� �85>O�7�û����I݉�a~�E�.zML!�7�������R�� ����$��7����#��q����_ ����!��.�)?-cV?~L��I09)�A�����Li>��o��P�@�� �=�){q����~)�](�]q�L�����\�����'h�h��\}�u�0_Sy��{v{�]�����.�=N��0E�z6?Ƌ�\z���1�E�� <9�,�V��.h�d]�3�� ����2U��=1�f�iwh��t�'��2:�\��ox@W>]),$���I'�j-����_��ˉ��0���:���C���ˬ��s�>�Y��U�R��u*+��q����2�D1&B@�dɸ�DZ�W�U�z~$�O�9�� �'�A��E:���4u��x��1����g�%��I2�&f:f�!���쯐^�oB���I�u�J��y�\q�����mBr� ����ћ��7lW����UFDE����d�w�)L��4v��� 6}�����j�&D�&�<������D��G���U���U�&��"���M�rv�U8�n���kI����za���3��j�A�]�����2��|��;�*��`뫼�}��b�wq1c�9q����=�!}u�g��V�ǥ��{�2��S|�u�{|xG�`+�� �W��T��a�|�AnV� ��5ư�@�"�} ��~�m�s��^X��%4_�#F ��;���K%<ەfEX�E1<DŽ��I��~�a��;/��5)�����T"���)v��U�;Q�aՂ�-0R�^�V-���wd�C��W��sۥ����� ��ա:���)�`�{���p�:��#�_�DS�՛��T8�w{r�\�E��7�<�}nN�o�����<b��yɓk�I��nM�q�}/��\����r�,�V�܃��U+qA��X�2����*~�'R88�Y�.BL��~�B��ީW�𫪸���㢥.��6b88�'�X9�y�c�+'n���*�%�5���L��p`�=�J�b9���f�B)4dz�wR+x����� �v@T��bb���4L�h���Z.�i� N��m��Z�R}�*��&tF�5�ŃUЙJ�3�ɿg�n���l�3�Y1�:U1R��̞G*������H�͘��be���#�O3�Ѡ��5J���!z;}i֬�H� ���1�����al3�� �#E�'�/��~���6���fT���������L��/D��%�7�1�����_�&�q����-,4�G^DU�0:�.�;`<���Oz}�$�Bt�~5~if1�5������]�b}8u����[�ѓ�̽��X����ﯓ�����d֮����K���������7т>x,�Q�j��>��@�L�_�%��qe�����z��o��M���Z/�E�X }�������� C�ō��N��L�c@_<��i�+/MAE 0(e�z$��=��Ϛ�1ғ��&j�Hզ3!�4��r ��A�F��K�����:����@�Ǻ��ȗ,h�,��=�����#���e!61z_ԗ}8 �&c�fN������FE�:�+FrM[G�څ�9,��Z~�������4,�xN� �,������`D.2$����D�8 �!g�H�?|���|X��������V3����T�%u��o�����v$�+3�[ҹ�}���g��zlB�+}T�h�:q���ej��Y�Zfvo���A��p��؆�j���yK!�� �Mp%&�--<��\��AQ��Fy!��|��1��T��aW�0�F&LID��I�T���0������^�ủtWf芼r������-.��x�S��j�����@B�t�������'?%�\��@�_I��l��l�;�6Xn����B�F�����_^ր.6��z��<ܘ�+�g��������ō �������� �<����{�9F�,�д��4&o�c�r�����w~��)���8�Xk����k��g�=c4m!�A�'�#_�:����S�A_Gcf��{�^����)���h�p�:� ��й����%��(����/߯�b �4���u�,rS�З���b� �w��{z�[������>����0c�=�@Dѳ�;ЪE�*5q���#褧5�N=��X���t&�l���HϋT��v�b�Ĩ�"����ڗ�R\���6���l��W�Ҭ.f�|ŭ���9F�Z� n��>��h�9ޢ���y��� C�xh���1�D�R�:B� ��z�(��h�%���v���Fq�:[�!=h<nl���2�Rh�,f�'��A1���=�sB�^8��]7ݾ���q�{�d�����=�;ш��0JZ��v c�]�����CRT�Zg�gkv����MU��щ�hV�]������������� ����o� G�A_�G�C�O� a�D���{�v�*�GQ��8<Z�̥5ǭgcz�lM�NM�B
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
General
-
Target
Bootstrapper.exe
-
Size
12.9MB
-
MD5
e89c0f434877674abf6f72f0bf05d29d
-
SHA1
61aeb6836719d69c4c4a6b4eaf49a7a8b0f57181
-
SHA256
6b42850c99ad863797cc3984d5662b6f2c1011c5de7173e407d920edd9d529e7
-
SHA512
b9d06087bba611da11cd06f2e351440f792f749c277f5dc330570483bd9c3ad2eb8d37d3f9fcdf77bb9c2d8de89eb0cb614184822dff9745caff5b77d8f0e90c
-
SSDEEP
393216:DjohTexrwABFcNMfc/CWxHsSCLpvRjcIYfsxqtIi:IVexrxFcWfcHHsFBRAIYfsH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bootstrapper.exe
Files
-
Bootstrapper.exe.exe windows:6 windows x64 arch:x64
8ab858940b8a6742ee9d7e72e2cdcdda
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 842KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 874KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 651KB
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ