�"�����Յ!+�)�V�N�ϊ���>���ZPaI���I��ڢr�~e!�[��ș�����C`Mt�{W��N�k���)�����|�#���['J�Ά����c��Bp���@^�ݱ�u}��N7��2ahs���g�^�[Qc6�g�N�5�ϰ�"Ah�;�~�N��Ϥ�<Q���M{\�bZ�i �?m1H�����@W½�9���kz�>�Xj�>�/��C�T��kT�H�9�s��h��j,�3��^�T�����B{3�X ��q�=�����Jx<�8�/�i=�^���L+ϩ_i��RR��J�y� P�S�W+Rj�b#��U~Yz�,J�@�9�hK� EZ�R�#���M��O�Σ�>O���i�ij��=·��3 "B���{]aF#�Һ�,�[��Y����xAmg�nqڵX�˳�8����ʡ������I��b"6��w�e��/�Y�j��s��AnRF'4#����f� gh�ה���d�%�Җ*q���U� ��OB�|Rm��-~�=!e7�Kx�-%���{�"�t�[��%������&�� �|; 3X)iH��9�+ǝ����#R/��?}�֧�^���l��Z|�� �l�T�+�ʉ?r�?���hFX�����{�Q�g���5q���>��3����V :�:�F\���֖�*X��J=�U���M5��?���r-���a��~���,�X��aH�k,�ؙ��h6�N�ot����L�v���(�9J*g�O��v/��k���d~�xEy,�f�ٍ���&oac��Q�a�h# \|�p�dRp�(x�u�B��x��F_��z-����z$ �c�=e<��-��ٲ9gz�0���w�3�靲��>����Y�\�l6�{$�[�/P�Ѩ�(���K�1V��zg��63���ݓ��oԼ卭��M�\��}�&��tp2%T�_!k��ØM]��+��|K����Ш SoJ�9@�v!�������RRQ����5���ϳ�i�.8��"��w��V��^{�Gn�������>���&�e�0�[塶��qr���#O���>Gؚ��3��gM��+�Ѱ�H��Ċ���������r���\ �@�����b�n&���s2q�?���>� 5�<*������m������CYZ�Sd���9�����>|���Ox��=���B�r���$�H��A�(gq��>�A���9���D�R�;«���z4���� C���圃�HjE'V��É�+�G�ڡ۶����&�H����Z�O�*QW6ܔ������5� .]췿:�tD�-9��e�TM�p��O��o։@X%��H�����iC�{N.��R������h�Ս=x��M�������~�?�Lj�8����ѓ�K���u2�G\dHj��= ���p��)ֽ��z��g���H��+��J�Gq .��z�?vE���"����@���,o�lpltl���;��~'��D��Vї}B�C^��ۀ���ta� 5������n��F�GN)�ikS�a�Դ���b� }K=gt;�sڋ_$�o[�2 8b���]�dGnKg����6�K~2���}e�������c��}�l*�ۦ�4F��ۂ�k�f��٨'��tz_� mR��爺Tv�{�!*@�֣S�+�!���c��WV<���������H}TU^��|r+�T W�|`.��N���٬�S@6lN!k���.\�����Y鬦����>���]2�����e��)�������:ڻo�7�n{���d�)-��N�.-߂;�#4���3I�o�<,�>�f�o�g�uy��o�� +������7��M �ga�+��WdE���}*����1��!z������u����@���M�q�N��X�嵳�&��������O�,��U 4���ثt���U��a��������:g�d��D��o���C���,�'�)�b��ܬM��G�c [lfR�2�7�0��z�B{�L��ϴ�uS�ч @�LԄ���Qz��y˔��%Y�EN��E�X���)�|W�FGg�,�0V�`N �D��50��E[�_�?���3TO�]27��Δ�Cb�^'�X}[�����8��B�ux.r�@�/߷)��xC�NC�\d�H�WLa���Q_��iW�J�d�Ԣכ ��9� #r(���n�Pr>^c�� �U�Z�u}1&W�>K;4��,�q,#02�_�<�U�U��ϋf�W��Cn^���|����9�;����F�J -L�٢�[�bص]u��~~C�kYZ=Y"�Y����q|]o5�ì<Hj��/*��k ���WG>�Zw�1ow�7��ن^6w��{��'�%Us,��u?%��!�#�MGPZ������kRqB�+�E,Q��LX�G���Ϙ��Ӹ-oꉫ�y/�}�]��b�V� ��b/���2�J�d�M��TZ�dd 4���o��i�� ��.�A��vGHzʹ�j���+�)^��εv�1�L����%��uT��,-9X̌�s����Ai)���'ŋ�T����ʕ�w%�ʙ%�"���a����^��˂Qw��g��@P��*�{�$-�p�<+�L|(�U.��5�pz)E#�+��� � s���t���v�B�Pӑ��T���(^]_������� v������?�)���qaN����)�|6{է��BX�����\FD2�/�B�D2�Eu���{����|�}��(���U馹E9�'�L�}�����[�ꪉ���pƯ�] �c /�a���o��:�ju�B�4�����9��o�[�a&�26��H��u�@��P������b��H�`���K�������u�0h˫��h{Н�8�\��ڼef� ݮ��v2U�v@�^7?��{���5�<��Eb��K;"7�T2 ���G)�+��A�����p������99]�e&8���d�y%�2����O1@�|��D�����q/����Y�eq��u�� nA���ō-f�i������|!:#���V���*
Behavioral task
behavioral1
Sample
11wY50tpm.exe
Resource
win10v2004-20241007-en
General
-
Target
11wY50tpm.exe
-
Size
5.5MB
-
MD5
3b38690db145fd74d4d52bab2ac78074
-
SHA1
8f93d77eeacbd1868942b4868e8303d63503c723
-
SHA256
6ba760d9873a0a77cf08fedee79a22656ed88edef185bbfac3418c2992d2dab1
-
SHA512
55c3f5e799a2cca8ed09f192dcfc61d21e529c426fbb4848a9dc90719f3710ef12f29375ca4b0eb2a846b0c83ee7f90671842ccfca3e96853e94de6e485673fd
-
SSDEEP
98304:aUsCzX5IW9GHi1UNQ3tNBHiIC1w49rY+4z4qZcfNl2o1l1HiO9Yz6Jy3XR:Rsp2GH+UNQTBQ1Hs4q0YozBimYmsh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11wY50tpm.exe
Files
-
11wY50tpm.exe.exe windows:6 windows x64 arch:x64
18564b1cf3df285f6aada8e4727159f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileType
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
ntohl
userenv
UnloadUserProfile
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ