|ν����9H�7���ƷL��q��M���^=0v��@|��|��\�A��d3�<��m[�>� �8X�R:ml�.; ���5���eV����W�8�#��Z��v6�w���brH��j� ����[�-ڻ�a&O�ff�.]����.����8˴^`%[KV��M�J~�ƛ��0�U�ֵν7��%q��x�.�W���QnoG$8�O�G3¿����tӗW*�!�����z�V�(Ji^�&�O�R�_�!��H��ZYT���<g;ɯ �,S�K��Ff�ʥ��y��H�U5�y�E:��s]`�cO���Ւ\>���/���a��|3��~PV�%[�pn��`��*�������.�Nw_Mv��|u��cN��닂����4��(��\����fb��* �颕�c2I������ ���rn�K6_tH�����5���j@%�����$=�I�T�vrw�{���=��Gœ���V��<���e�^ GZ���x� �U����Lp��*�vE�e�c�Cu!ë�������п��t�6T\S �u��N| vz��ʶI�g��K7i�a�&��%�Q�˔�NZ/��f� �Hei�����vG������/A�fDU���E��j��fdV�s;۷S��<|f�{�>�vω8i���gf���P��r���~\�7S�E��.�����z��ZMO�D��y2�n0�![֢m��is�o�D,�Ew� �YNƅi��p�;OJ+ރ��{D̃�Ys�A�;�X/�������LYW���?�|P��&������$)hw�ҝ��������=�������"]��?��mWI�踓�>-�_�Yڪ }&����ġ��:]r�nKj�F\u#(��aґ��Gu�W��҅,��>@�������ƇkQlp�h'x̯�J�7�C �_��li<�)��d@XY���Z*�e����~������,0�]mD]��;��G[�$�Ǡ� �T��;D�2�d�N_{$�����t�s�ⱳ�$�z�d"�� ��L��O���dofEiI�*��U=e!�/B]�|T��B�����!8�xV�<�#G�3~�Pr��DrE����3����As �D�үMr���+���O�� ���*5���p��]-D�$U�[���nx/�L>u4���GAY�E�U�O-����ճ-M���9�І��c��F�p�D��τ�o创@��9.���8�����^=+e'A���Yq.����1�K-�g�jF��8�������ӟ�s�u^TOD��2g��?D �]��1r8��h����rN(��h.+��AP�� ��T���h6��������Uz�SW6�'B�3��d8A��uT�ˋq5i��%u!K�㧳�#vXK��(N�t���+�H�3O����E;Ef��w����x@�T��u�E��3�լ^�א�.xS��#�i�h���G�S��d=V��?_�����.F�>�,�3E�l粤q��N� �g�Y{��d�{I�R��*��jt�����X�$YZ=�u|�9D�o ���{�`| t�����=�Xf:|TY$��&���h����?�z�2P�1 ���L�z��[oS��n6���ɷ$3���й�%dB�x�/���H*~��%���M�Cr�]����71�GN����zʹ^�@Fy�mu� WЪg * F��������" 0S����I�5I�|뚆�A�V�YY�GG� vF�E=�\rY�,��ʳKDl��6��KڢX�����Y����n<�L�Jv�@vPu�>�����#/�t��)�4%ٛ_�D������# ��/gh���3�!�+;���K�)��/�Mc��if�:^"����p|/[y���t5+�d�ejB�vg��SnV�.�{yK�-�RR���m6ʳ�ׅ��,/���v�Y�HGq�ap.)��5�[#���rG�a�Ę�JH�����)C�ug�_Y̹�N���P�kB�8�:�2t�0ud�b�mgy��i��u��mB�=�'Iy_�I�x���l#������%?5@�8�m�O�S���?=J�^䦣��'2��2�o�\l>N����i�\c3b������kv� ]7�W�1��g��K�=,~�7W� ������4����ך��4��Xu��o�ǝ�N�,�ѹ�T�dD�m�~`��;��b:���?D��D�U�C��9��{(�1���<*\*��=�W����|Ɯ.o`�noCƜ����r�X����z�;kd�T>�^�{� آ�Z�� ^@H����r����L �M��J�-�p�E�*�㖘���rOH{!�}�&1ـ͒�Wt��.�E�c��J ��E%j�����2D�kI���pK�^ѡ��2!���y�q���"��w9�}Z6o ���lz�ٴ�h��ic�>M�2�O��h`�u�x��ի�0dž�Ed�k2�Լ�Zj��4�'i���b�Y��`��m i�x7c�nO`G�]�d5�OV�EM�����S83�$ �^�o�NYlKS(#�^������~� /��W��FTt��������+֊�@ksC��V�"h�&+\�A�ɇ�����ll1��cqr����/�$��&�.���� �-wZ������ca����{欺����{&4}=��%�����QcO�M�7&�!`O�ҫ�y%���텛_���ė��*]<R� � �0�Ѷ�^S蟚��)������o�%)z�+�Q�80������3��[�V�4B ���+x��к�e�xEֿ��� �x�3k���zPni��Z��@^�ثخ}�q$w.2������4l�O4�Z�=7J��}���F�3ϗN<V��1j��6����^I�����;�<��vv�[���I�7$��h|��c�>ж�2�%[�$�+9:���Ge%���I���,�ҷp/s'���~��n�*2��a�I�4Q������L���UҢ������9%>�rФ�I��i3��x�i�bҋ��p��Z������N��+�R��鉵@O��}��W�>Ү���!�bC��V`:l������dZ�O쇋����
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-25033.exe
Resource
win7-20240903-en
General
-
Target
00031-25033.cap
-
Size
2.7MB
-
MD5
3d332a0579642577cc3bc396bc76be62
-
SHA1
70181a8a673b9dd5f3c63c063565f95de5d3fead
-
SHA256
bf82331ec71f451561740c3aadf3d534752de7a1003e1dab625b6a2b962f056c
-
SHA512
2a943a878e50ad2c21a6a10307369652db35c3585aa34b6b134dddaf9e3c0d520672edc50afa374febafff46505b595f38ba9fa4a4431177cd3165cb8e76fc44
-
SSDEEP
49152:BXZx2h5LGWQEFyj1UytqsFRFA5ML54xp8Lb9cTSI9+d8iXiYqrrFw0XieAUuQJbP:BKW5UyzFR254JcmD1y4mVJJbP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-25033.cap vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-25033.cap
Files
-
00031-25033.cap.zip
Password: India@2023@@
-
Device/HarddiskVolume2/Program Files/TallyPrime/capsules/00031-25033.cap.exe windows:6 windows x86 arch:x86
Password: India@2023@@
8fbdf34eac3f31cc409f546c243e0a5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
RaiseException
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateAcceleratorTableW
gdi32
CreatePen
ws2_32
gethostname
comctl32
ord17
advapi32
RegCreateKeyExW
shell32
ord155
shlwapi
UrlUnescapeW
ole32
CoUninitialize
iphlpapi
GetTcpTable
netapi32
NetShareEnum
wininet
InternetWriteFile
mpr
WNetGetUniversalNameW
oleaut32
VariantClear
crypt32
CertEnumCertificatesInStore
Exports
Exports
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 634KB - Virtual size: 634KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json