gS����(�G9,콴vOnL��>�I[L�Hgʈ��<�0g��/y]+�s��qy� ��ay�%����Aih �W�w��5aZy��$d"�����S��k�Y{tè����5��,�^QB���DS�G�7Զ�#OmP�ٙ݀.z��/���B%܁���9���3Y�ꢹSY,6Mp����j��������#����Bg@����9Z��v���Kr8,X�͵��2f,�O��������ӛ>Zb4:��'NLm����Ȋ�H^Uw W������b�nW/�~[N��):�z+y��?�+7,K_*��@����)Ç_��\RA����ؓ�֊a��/Kb�8,�Zd�,q-�o�`s�Ԅ��|6���R�^$R����M�ڝ�?)��ˣqG �P/4Btk�f�L������^U&����}F�� ��K�n"`�ժ���(Դ�W*�09 R�s���{IG�*A�6�������~�e��*�I 2�=��U�]Z\6\W��u6��ep"FFw�E�n�(�3oC�m��r,)"۫�_k��d�% 8�iVڈ�4��gBۧ{Mm~��+����E�Q���'��k.L����+Y����)��!��प.��j3��qKM�HVק�oc,�&����+=,(AZ ���i�i�)l�*�)��m�Q���rd���l�mʨ%� *��a�'[���h�T�Kډ���P�v���E�^����.�.<��N�]|LO�:�}�a3~��y(T7��z���_��Ǔ���?�Od<5��o@EY���Ǫݛ:��I�8�+�0j�ޑ�: ��������[�Bv�� |�:F�������0Z&S�0�S���� ���< ϧ���+z��֎s��Q*X�o���C��&�GKP�J�'�JZC��@)t�o@�O���c|B�j��}#��K]�R*��u%�8��Z�����s$Ǹ�d����W�$�mo��RJz���������se���U~��θ'S� /qWwU$V�HF$G� �>�B��Ebs�)Ϙ�B�9��+�)�k��\��`��p�(�GP�s߃ж������ߊ4�(Y�<�,�[��'g�ᒼ�~\ի������I���ܥ����w�UF���<3S6lT�����,e*����܉��B��.��TRp��AP��%E��H����\��s��zbw�,.����_+#lq�=�c~8���-��T�4��h��o9 ��`�������Ν�"X[�J�MS�X�)�[���'@e��!���T�f?���b���e�>SP�B�JM�퓴���~鷘Zڀ����+T����赯�=۔~DJr}�m~_��k�����ιtk�^�CC]sE��<�ŀ�]��@�ս �[y�Z�u����o�����:����'jM?�)0���2W�-���UMl�`|����{�� ����uk����T�M�7"pH�����&N�jߔ���r{��3�4͗�Ǘ�����"ryK���0�ҙ>(�6Ѭj���A,Ϸ��O?�^c��a��eos��0�B�LZ8Pİԧ��,��5�mr���kYz5AZ�U��+��f6-(����Z�j_�ũ�Z�j=g�A���,y�=0�I���� �GS3rU�u"Z �rCs6�'1��������n�*ذ�}L���ZB�84�`7�5�'�5�N��B��.n �� �()�6�;w�L���X�t���^kH�u����[��8���R@�m�� &���Jҫ��TXwc(M�OLpC�9J�(_�y������Z�k`?��7��w<�b"$YI�v;K-��j|�u�&'���C�%8cn0f&��������(b��8j3�!�F\�� 썐�I�����$3[Xc]y*P��0LT���8�>����.��Y/�m�?/UV7|o V̔q�d�2C�~��>q��3sIc1�nU��'P���ȩ����#��c.�@�[*������q250v�.g�J�!�c ���)��<�|�j�~(j?��w�7S��D�TB�o��>���;�q��_9&�7F� �kM�ҍ"(�x����^[�b�$�ҰY��Ľ@\8���Q�A�r���TD�h��6���)U� ��0���md���2w�_Wh�v�_@ džI��M5ݓ$u������ԣV}9�\6õ���9!��������h|�>N���z�$���DQ����<���!_/t�w�� u����N�Xw\d��b�$�T��O �6��r(FT3�nE� ��d�SI���<@�%��xW�0V0\�7{N�J2�q/��8)҆��pz)���sL�+�V���غ�N�i��hQ+��h'�j3R�O{w��;�<M�l�f4�O=3���Z}���Z�^˿�%�B�&�Ojk!�eY���t�H���c_���i���}aC������k�������5m0[��D�i�tr�;��W-��@��� 4� ��z�;U��w(�3���8YG��y�!��\���~" ������c�'͍�P�zϞ��T��5>�]tU�E�����?��U+!W��.Y^!���i��Z�! �l�{m��Hi�� �wK�ۺ]�zΏ>�w5��S$i�c.�~�:$���(���Jq�s����Z�j� ��sSĦs���:����I�b�;;�pd�g�.UYY�� }���THC��z�S� `9���P�^Z�} Վ$_�[|}��S9{�S�vςzC��������adŶ�x�9��%���*�Zn���t������i벃>��\�1.��ؘkRp�E#�d�Cjхul/��DwQ����:�_��)��:\5�����X�z^�b�{�D���Ӓ2q�,�Ct����v�e�8'( �xb�2*������|�6�1 �>�8�8Ф4�lΦq��.MJ�c�k �0�{� {?���s��F'�{a�'���<���FJ�5v;�X�6�&�M�ɏ'�ii#�fP��r_&�r���twK=�Y�x��&SdՊ�HYn�%#�2L��ӈ���1���O�+}��OAoX��f"G�O'� Hk8|t���|�)��-�k��K�`
Static task
static1
Behavioral task
behavioral1
Sample
6mQGlx.exe
Resource
win10v2004-20240802-en
General
-
Target
6mQGlx.exe
-
Size
9.0MB
-
MD5
08714bc9a3d727285f33d9b4c112c3d1
-
SHA1
3b8572fccd7702c9ba0cd8f423cd78f12dbcf79f
-
SHA256
3c9148e6aca273696bce426680fe14af8e71ff8fc89ddc13d15191d9cbce1dbc
-
SHA512
55c3e2ba2f9275d3f1520c9640834f92048ae29e3eb9f2bcf5451ae84ca064370c9f41aba3965e22e92e08a45ad4643ca212341c5417dc4b4f5a75e24862a6a8
-
SSDEEP
196608:SP8aujV8nx+RCPIW4NV8rIYtS1QkqMvD8jSMDYVj2474r0Ltf:SPiV8x+RCwWHtS1CMvDYSIYj24qa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6mQGlx.exe
Files
-
6mQGlx.exe.exe windows:6 windows x64 arch:x64
118edddae5bfbe33bfa95e5c34446de5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
ws2_32
getsockopt
crypt32
CertGetNameStringW
advapi32
SetSecurityInfo
gdi32
CreateRoundRectRgn
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
user32
EmptyClipboard
CharUpperBuffW
kernel32
OutputDebugStringW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmSetCompositionWindow
winhttp
WinHttpConnect
ole32
CoInitializeSecurity
oleaut32
SysFreeString
iphlpapi
GetAdaptersAddresses
bcrypt
BCryptGenRandom
shell32
ShellExecuteW
shlwapi
PathFindFileNameW
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
normaliz
IdnToAscii
wldap32
ord143
Exports
Exports
Sections
.text Size: - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.#)a Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5bi Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.w6i Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ