_F��<)�2�/<.���8E�alָ(���C-ص��V����S���c���\�C0���� @\�U}�T9GE��A��Z�"� P��Z�|���Y��s��t��#�=hr3�2�G�$e�[�#z����A�G6蛖S#����"��6��.�q�-%����R�Ľ6�^��Tܾ#��O6Tu��%��%ÍF�Y���[�a��㍣����j/٭Ca��~�D:�!���G>VuJr�b�������?.����!�K;7�� �t���}+K�Cb36���aM}h���2�V�?��8`f�˰/b\R��̫9H��U�N�m��N8+�����1�կY�ޣa�awv��_�2�ؕ�N�;>��1E��ڷ[�`1�U"���`91qA���|j�1fNj~�L�������v�N|�$Z �غ�����Z�U�4�(ק���&--�~����ٌ���(�d�R��*ZpԪ�"���@q��Ub�Ȱ�͢A\#�t��fK���wK���M�?)��&�Fv3����z%��i�(�I�(�]���%�t*�%�V�@����]�4/�,ݽ{Mg���Ń���G��L/��h ��m�G6�Ao��<�2^�����Yi)���T�-r�V�z��mS�\�R CΩ����c8��(|T%Q�}�ٖ��hjd��+����d���u�>f7�S�WV����3�n�N\좿 ^��) ����5;.Hbg�J^����Ż@E��ۄ۔���s���o0��#���zv��R�/�G���V7���<g[�)��N�!��M�Q ���!�6��e��-[��F���nES�Z3���&�S9"�!�j�Z,d���QCN��<����Sb,��v-�wq�Z)��Z�1�7z��+��w6����@i���g�Q1�����P���V�s�~$`��\x���^q����/s~�fg �D#2[#rv���;����^�W��sҷZ�� Y)NuO^�������c�-g�(#(�%w���u���, Un4N*�&�Zs;��� ��C/�Y���~ ��R�ƃ�����@X1s��CQ.<? UN�Ť����ʯ/�U:z�$�).�}��-|U��;l�ޓ�%#�x���=����ϟ֤쩀�H�ڇ���=2a��M(kG ��d5�\�|�w��Y�Y��pC��3r�U���a������=�Otv�=/|- �@;g�u�- @��K�c���A��6K���3�:�+IG�*~�fk�\CS��p�uT8t *ͧ{�?���^ii�Ĵ��5C�qj����&��6�2���'�����ڭ1��*b�pՋ,�� !kC�eD�G芉�֤}x�p�s�@����Q������[5:��O�/Ln�fi�G� b�b�>�rb�l�����jܱ�۬2��r���v��W��M��m�$�VS�p�p�=QJ4�� <����� �6F�'m������ rs��>�Y�=������v<̰-5׳�.�~4#�}��|^)r[&z��[��_��5D��'�J��ˇ ��1�L��b�czn��?�1=֪L��ɣ}��p $�惄V�W�P���N9�\�0�U��! ~��mo���x��N��͇���C��'��(�^2RЬq�ؠp�8^e6�*FE�L5�q� $ ���"��Z�FB�j*�>`57E��t��<W�>�g���SM��Q�ݬX�ƘY��i�k���hv��K4��7�������)R�2�_RE�.�ս��o,( Ӑ��)�8�l��ϑҏ`��bh�O�w��v2��noPT9{�#R�cLbV���N��"�S(�o|C�SQ�r��.�ʾV����;4G ��f#� 6T�2����v^��1ڸ2Y{�\s��N"�Ϗ=�L��H𘢛X�ٛ��,*�NF������|��j�����q{�B��=�=UXk#�"L� P�z���*��D.�mȞ������V3:���X��Bӕ��C�{ё�t:��c��a���Fm����|���)h,ގ��!>Q��d�/� ;��ޫRz�����@lS��(�,�0���k��e��ރNf�}*vd~4���G.��촱��%�k�VBlUh�d_5�.��$=���.�JZ`ҹ%T�7"�'���[xe�+H����������\��EU�B���� �=��������$��k�I?�ڱ�d���X� <v R��BvU�k�EoK��6,yRb΅�<LB�-�q����/�_ދ�1q���e����<+^Ny�����0�@��"��i��}Jj��XrL��*X��V،�{c�#��JWS8���:� �3�V�I%:6�Ҥ���z��1���,�E0 A�Τ^��b,�se&T�]r��ak�-W�Y��� 8 �7R��o.�xs�}��J1�n�5ћ���Q�fVH ��>����F@�j2����_������9@�aIrDċ !9�|Y����[!��Ѹ���K�,qz�Ķ�'&�q�Gq=��9ӑ1�F߅H�O;f ��T����t@{�P��I�Wm�� ǡ�;����v��&���e>#5W�z�&��7�.֢1���� �i�O�G�I�;.a��m�/^���֊�r���6��j�Oo��f��VX^g�̼\v8E �v���wJ\�z�;��>�m$gG{.�2g���$�c~�{⹇u�q*����R��7E���Մk�W$�^�erp̳���TM�JtI��q��3��Xr�vG�_]&��hx�豇�"j"4軙��B+�B�z�-R�� H�����{.4O,)KG����z�7/X{tbǕUc0�מ�C�l���&h8�f�L�������y��W^B�cS7ߩaŚ��)�=�b0ݔ����ґ�(�IRl�@���e����65��@2����g���mYˡmm#q�]m4Y�%,�����ӷ��OX�K�t�����&n-?=q�ո��Rԣu@�ik9�?J����D�M <k�Ý瞝���A��;�C��o��Nj��]�v�-��̢I���H=? �����t[ �H��E$�|�q\
Behavioral task
behavioral1
Sample
ALHACKS VGC.exe
Resource
win11-20240802-en
General
-
Target
ALHACKS VGC.rar
-
Size
8.8MB
-
MD5
41a0b948cbadf84e8c053ab20e6faa5d
-
SHA1
78f83459f2fdff94d2cb397fcac289b322b2d7f7
-
SHA256
d3449f77d0168e697ffcdaef6df772543e0bc3a18e9884d195a0a831613b5c77
-
SHA512
6ef4597dd90df76151c4772c8ea9f3433364d3d51c1ef253dbd65cebb9e9eea461391599a493f17e53285b8ca7be45fd6ebc5c2b599d48b4751a7b82c6003da0
-
SSDEEP
196608:s9go9hTWEooT8Js8At4o6kiO6TUE58a+fTUbg82okMyb0:snPVY61elPOZGbgqiI
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ALHACKS VGC.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ALHACKS VGC.exe
Files
-
ALHACKS VGC.rar.rar
Password: 1234
-
ALHACKS VGC.exe.exe windows:6 windows x64 arch:x64
Password: 1234
238aa968974d394addb6b5d70e6c42b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenServiceW
msvcp140
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ws2_32
getnameinfo
wininet
InternetCloseHandle
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__intrinsic_setjmp
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
user.ini