'������j;����Ns�z���&��o���1���:\��f a�E�E������Ƨ�����,����e� ��[���2�w:���4�n���+��l�����1���?�sĕ�]��o�G���������K��%�H�Ӹ,����I�!&�RTa;��:��;�HB^�n^�M:vB��2����V%���^� C�/�g�&g�w�k��̩3�x�����3� 8I�c8ȑ���u���4e�S^5�wo�I?�_���1������H貁��9��JB�YG0�9bL������;�6q�Xs���8~Բ3q�lA}D�H����B�Ȫ�7�h�9�Y/I�gA���H�D���6�W��ƞJq�J�j)���Y����sl���C.9����cT���H0 ��䶈��� �F�GK��:��5:_�$�[�P��)D9�lo�M� _�/]���͟���V؎V#�/cIF���o��$8�D�h�GLҷ:�X��>�OÕ�>�ٸ<2�~�k,���y� g���j,㛒n��(n��7.X*����g)ؗկ|�������ySO��6Ap��!�MT�� �J�;8���3[������# ���:Z���@�` �[ʨ�����"�nM0��v}Z��}��S%�3_&I%t����20�$�A��" ��=��2��H�! 2����q��{��GvJ�fɄw}G>�9�Y��f��1p@U��{F���;lk�f`�jdӎ���ĺ �����~�1r�t�{\�7CT�}�Y�(���?�i�j �%�9o����t�B�|��}�E��sI�t ��n�)M��+�pY���h�#����#9u�Ę��:��(�Vi-y��L��v��.�Q��d�� �<.� �*̲iUJzgo���J���vJ�f䮙���9�9�7�.��S���vMDg����N��E�2$�,�1Y��z���WI���j���,�����1<Jm��n^W���#��-75��,Ѹ�h ��\���m�{�����=#Xw���xw�����0�j,����&�����Q M]� �a�),G~��_QT9cO��BȚh�U����-j�c"�e����X�H��_�V;r`Û-���s��s�y�4�<`U-�N^�`~���~>AA�]�� p��)�x��,���y]R��v���T�x�Gc���'�a����o �x�YvC���V�4���{���̧��o�f-(v�tz��0Ѻ_��Ձs�F����,��C��|�rj���_`Z(4��5.�gT����>`R�k`ͽ@��^�P9��.F�Ħ$y$-�������Z@z S6�s�3�n��'º��D@�( �Gc�rr��>�hZ,��F����f�������`ѫrUfn-{��;c�?���>wdl���v�u�!l!�+�;#��͕���Cw.)J* �I0�ǧ\y�,�2����q '���p�J�7I�n �u۟����<آFyrW�H rr��p<�1���-�VRh����o1�5��>�����.-Qz��R��#��s��;\oiܵ�9���*�J�(&�3�Ab�9Τ+����H�˹! ,�o�5̾6K�_&�TE`�ş}���F�"�q���$�#���q����2zړ3��n��9�敻�iws�/���<�c}�A�W�>�ꘘ�ݹ�����b�.#�t�����h�)?j�Xu��_�X�����Ŷ�1�9��-�����G,=+�M�m�[�/��.UbmNMv�q�+��ͱ��He��F�Ρ���<��B@E��i�ɋLF��LI����Sy(B2Jק����5 �6��_&ߓ!�/�!��� �h )V��ppp12�E���iSS")!fךG�QvJ�`�j�7��#�ܤ?.&)x�%�x�w��Pf��>@�*\��[T��°�u����9��UT�����Ț�E �΄�Y��� �������#�P�;���������0���9��[*�d ��P��ʹ�j�\��]�a���Ձ����`3��5�B�Ԣ���Ix1�p�~&��U�4iC7�����̀%����cC��|S��-������;��X�F�\><�������@T�]������Ռ-������X:_��9N������0a�(Q��g�z���������qp�}� ��#>� U�D_q>��iE�@z��m��l�%�ђ@��&�EV����e]#,0�Ƽ�@�ec[l�H����x��z�}Tr\��'ҟ �h���2� P���ar1+� zka ۡ�˃_�N�cV��;��� È5�s��Ԅ��L/��+y�ɱQX�~�����c���"�:��/��<t��m�\0������蚾dS^n� 좰�DA�w3�]�M~���f����j���0�J�UفlD=��3p6d9�C�h 5،?���c���A�={�� V�IYw��CN4��LS�!�V�O:�z�j�S{�4���]��i'Љu�P���N���v�����M�lo��2�-Y��?u(O�RL�|mx� ��@D9�5B u�t��p~>6��KH���G�ήE �<ڥ?����}~��@Ӕ�|�lc8l�@��o���ct���@�f���⼋CDP%��C��Q��c?b��UA+ vH�����7�/�#��ċ�i���;�@�Vm�;u���r��r- ���ڞ:�f�h��-���^�<ױ`s��I��<4uF�U���/�R��r�D` �7+�O�ݿ��6�j����?��a��Z3M��V���hݺ]soQ4+﵇=�{D��p�����>f@t%�Εj���7�$*�?���g�OWs�K�ԇ�/!���,Q|ۘ�y����#>��9|ם!D�1��cs�G`� 8�;J5��.�e�kB�FR��l�ھ����4je�R���ͷ>���}���̝�M�n�c����^INҡ(���^���m0����e��ƥ �Ț�=��,6�g�'� �]�k ���\C�fM�O��ƈ�5A�s��Z��dL�;�HuE��0o��A�%�#ҙ��b���8hZ^
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240802-en
General
-
Target
Loader.exe
-
Size
13.8MB
-
MD5
d6b96e5b0928fdc1a7b1bbfd0ea2e4ce
-
SHA1
9c059ac23edefd84d7c98ef3dca60d81496ec8da
-
SHA256
9393b744507b4e4675513576891c6a111040fee6a322c1d4cc2902d51377ff92
-
SHA512
084426ae03659162650901c298bd3a8e44b4fd3dd9548d03ba59f1f7de1dce94aedbc96f9e93e1a813bae329bde7b81d5cf88eb78fe57bc23d38ce1234fb2467
-
SSDEEP
393216:NB8o7dMo9LxmMnVr6CJTLKxr4wSsnljQbfaUzkOP2sqh:sWdMofmQNLKxHlEbfaooh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
3aa1265ab72a1e554de2ed70be9a5ded
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
shell32
ShellExecuteExA
msvcp140
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
concrt140
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
crypt32
CertVerifyCertificateChainPolicy
bcrypt
BCryptDestroyHash
winhttp
WinHttpReadData
vcruntime140
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 839KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ