Ah˻p�F��,�R;D����,�b�̉b�K�qxv��&���������H|�C�� �N��ns�a���mI�C?<�>#���y�Z���;�Ǫ&$����4��B����wP���t`A�/v�#�JMR z`���iy�f�_ ����9E'{5F����Y!ǎ�v-�k���l-ds��7$���� bbT�7ke��0 ��y�*r{�������'��T~A�|ȝ ^~LcXR����䃱�v1��Sw(ď�Ǒ��;}f&�<�� ���2��Σ1�Y�$��YH^BͶ��6��R������\?�����x<<��4��崘��~��=f�Wd� c�+�C�_�B���(�2j��C�8��Q�c�j���7e40�_&��Äu�R}���CZ {<� �/���<Ћ�������y����qC $n�X�e`_���`�g�5F�[� �J��a ��l0;�9�0�@���<��Fc��d# A�Z��VDK��PFw�&fcr�������4��^D�ha����.3-�����F�������R�ע��>֪��q(��nwP��Q��э�Ac��"�a?���T���Udw���o�� R�1�3��x*}��.6G��}\��~�GUOwu��c����>xu�BId���i&�m3��� s�U-�?����3��l1�l�qx6�(ަ�c�i՜O�:�TSP��+$��T��KQ�0�b�Th�)�{ ��M���wڄR�Vt0\�oo1���7�L�Ζ�G�;��%��W���.P����Kܭ|�|��c������DrJ�{v�;T���[`+Ұ��`���2e�HV�j�������}cD T;Cg+�=�9�ɠ :��&?<��p| ����>���0|.��,�FMؤ{a�A��ѿ-.lؙ�PęaV����D2��Mnt#�L�����o���=�?c�0����2�Ta{qy���(_��6�A<�Tn��K��QQ�㸄`��ê0�ި�8H^'F� mJz���锒�~&$���f����.��!��.��w6��תm�C9ϨcU��Ga��V��M���`��t��$B%j"�7O{{{��/��$� cƭ�M|�.�:X�kC���]�3�|SG�'������DT���l�F�z�=58���͛7����*��[�?,��wSFh��z8~���ȧxϳǞ�����8�.Y�j�_����p�z�^g�8�A��k�n���%��`��{�#a�|������ߕ��v�0���ř��C�4����������Ģȇ"J��1�Oƥ�04 E����}�0��!JG�X�5�2f(5L��߸[���k8MS�p�iՓ����W��(���c� e8�2�����U�nUe� ۧ:�V���!�)�o���ۤ��*��r�$���^5CJ4�Q��({}='�<_8�+C �<���")�@XU4W�?��K_�i�L�E%?iOy�%�A��?V�QC 3���7�Ή��k�wQ*t���M9�hF����#��"��{mE�a�i�������.B<%�QrHs������C)خ*���=�{a�/���؍��T����=a<&Z��n��q�ϛs۵�x;DM֖�2�����|c9��e�u�֪�C����_��YB��'�<��@.|)� puR�{i�|��;E���W@�WW����}|�-*�r �J� .�������K��V�h�^Z��s��AE�� ���G%�Gl̿���YʙE7�;\nlʈ��L�QzF�H6��A �9�@�3SN�3��v\[���� [ԁ�EW����a����@uὩvp��ēHht��Ab�T"��6.� �K��탳З�I��䅛�9���BQN4�MW�V�ic�+��%��ނ(�Y�h�X6�sGr;�M���el���Z�c�NK%�L�~�#����@h�����N���7w�Q P� 9�9QCR����.����D<�BR�6�Y�����X�G��������9ӡH��}�����X�/ŋA�yr �>d�̣���[|�#n��s�\�������{��5lV�J/���=zJ��C�ނ���b��ܚ��8��:p�l<m�V�%p7����VIGE�bX^Ё����G3g�Tb0.k�91������f ��[����cG�k�w���W�Ճ�wR+}��k��]Pf������gor�Y��B�Y��Tw���`!V�r_�}}�e����x�Q�y#�D������ɓ}�MͪcI���c�����/�SPO77%�GlM�2���U�pRӕ��ʹ�Ѐ����ͬ�������O��*X��Q�]�C�b�/� �Oz3!w��g`�C�� �aS]����0u?����V�)/}M[��� g�T�]�}�����rq�����y�� w��*E� hwnu��� SZ�gSk�|�N1�ZfQ�܌�{ɤ�NYH�;wr��~G~�[X�;>]�Σs݈84}}g(��hӱ�3�Y�}�1���_�<)D�2U�GE�>z���ye�n�d����;[{�be�tEu���B+���MO^'lH|FC⏬Rt��Z���C[ַkw��1�Km*ƌ�Oq�Bv���Pn��~�Hy����O�m�ߕ��{�e>2y-��@lkVq �zQ�M���XpB��C]�����iY�L�d��|��=��{��?��Lr��Knd��3�ϡ�8%0L�ӹ���~�e�!�=$��)B��[�#=�6Z�$0a&R�R��1��q<����4=��������"W����F{��W�\��B%㣟�k1�u�"��e�������J��CÄ�Gh$�G��sVo` ?�%�����c��� ����L�.��%i5�3��מ��l��Zɚ�~2�C�������O�LI{�Co�U��t�Q��;����ɑ����#}�C�z��2Uτ�wWV�����yH\������gҘH<�C!�-�6MNbar��y�K�4� �z�\�!3X����q�p�a>~���0���aQz��7�S���I"7HN\t���'��h�Y
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20240802-en
General
-
Target
svchost.exe
-
Size
52.4MB
-
MD5
1037a5c6f55198afb2414fbdaf6982e1
-
SHA1
a3d7ffeb3100a7f4e1b51453c29ceb3b89f5777e
-
SHA256
02c5e53068ab45e9515e1a7c93008dfa4a8094387e4eabaa8ff024e06cecad36
-
SHA512
91fe6a243ee6ac5bb59b172633df25764758748b43bfef8730b492e516732d7ba7872de674abde858019e68de3e147430060446a188b9510ec656a386854f19b
-
SSDEEP
1572864:jU1Jsxd0Mtmc3eN2f3Qv8Qt+FOC4RBv+lJto6ZRJAO9:vVQNylI0OHBGlL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svchost.exe
Files
-
svchost.exe.exe windows:6 windows x64 arch:x64
0a1244f1a4638d06c519228963178a8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
SetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 50.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 52.4MB - Virtual size: 52.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ