�BP�����-�(���������g���Pڤ;=J���LM�� Q+��K���\��"L����o�R�h�,[��j���${�\�m��2 ��O��pQ ���ن�t;i��QFYGL�Xj�:�jc˫T��n9����E־���<�4ʍ!��<A�)��N��g�S(|Jx�A>��='V��7����]~p�������N+e���ii;n�v#��ӵ[�/Ru�"�U��g�{?��52x)Eub?Zw[��9�E�%Y'G�sjW�L����$dG�"��RV�������a�C|�Y5����ک�S�p Md �_�$"��{j��x\��wZ(1�ʍ5 ���� >����O�mx��r�#���M����k �?��!�"]����Դ����Й�&�dd�*���n�t�����[omt��9��qT�Ov�"��-u���?�h���Ke��mɽ�A�e���v��e��[�s��e�øsZ��.���F�u~�J:���A�]����|��N����Q�W;�ku�����4��W�Լ�9� Hސz�c����nG=�һ�4����50zҮ�����A`�mA�r���}݄A�Mɚ%ْ�Le%��US�h`NeD�^�/tP8ҋ$sS����Cb(1��3G�uU����L5Si�_�y�e��g��ў�6.��)��!��)�� ��//�7�s�(��~��=�^����/ix_V��B�,�������y8�6�S�S/�#��ao�V��XT2~w�l�Tj�}��A��ɹ)��R���b`Z��6�V�t� }���?IIև�E|�/�(��A�s�9�G�-���U�U���}[�����hV-�t��Uj�W�������� �c�7F����[��-��9���P���pvU���p�m:��APBQa�(�?�aU���Yc2c�n�KBF囪���(R�h�dc��~o�6�oWg��n�W�Z]iO��B�2?>-���_��ٚ`��x BM���.~׃ǝ��� |L� ��k"5����(�ܤE��G����8�]��U��'t���E�*ϛ��"�:��l��1��/%3i3����wtʸ{�$�̺Z��\��4d�A^L�.�#K���%�b(�4���e �6e�V�G���������v9�,0>xNT x�q���di�VV���X�<7 k��W-$�����7����_���L�͏q�i���o����uОVB��fH��� �*���ۆ��>�'�o��pm5����I!ѼǨ����`�R��Ѥ��K.p>�'c��mZ��3������X��6wCG���:Y��{Z �25�j�*u��wq1����B��A��ɺC��=�Zۆ�1ط�/~���PJ��w����BP�~��� ���efU�4n~��`]��LY��#�nS���蕌*՟�^�Re>n�OLr"�Ấ5Q��cA?��ʜ� �[@]I*/1pInMi��v#�H��<�������`�F�0���TM(Lp�dK�1 \��{�n����噛��@����Ej_��{�/ȸ�<��������||�mm!BM���n-�6�U�@�d���V�'�Ӹ̓� H^�i���m���.�U�"�s+Xs%�$��!W$U�:N>l-k�@� z>ѽ�O���!��+ Mt.�"��얉A���2J,�����pw3����z�pA [T�[4���w���:/�k ^7�6�q�x�ʭF��em����ӭ�js ��M'����4�W�z��� ���.H�H%�k S��d��&(b,�u�}2����M_CR"m��������k�>oE����I16���z?naV���{�)���lc#��� �/ ��J;W^������:�ж�청9ͫ<I�dq��0�������y]�� �d���<�ag�T��]w��^�p�s Ϋ?����R�>"�JJHO�D��%!�\4���|�rwFV!�r�M%����'k��ޛX���X�L��֨� �#d*sfܣoS�@�K������F��S���$ܬ�����K�l1I�Bh�G�L�YE_��"�[Oz��������/��A���9v����[�9�?����Y��[:u(N�p|�$.^���x������$�~߹��A�O8�O6�$DW>=�>_ʓ�C `f�4��� 1n� � J����6K\��v�ݬ�/k�Up����w���Y��OgbT���������n�:�3�6������t�O)/#�����3���P'��t���Xxf�G6��¤8M�h`�G��#.)|2A��:��u�%� �ۘ棂=�~�i��W�H������=y��%��f���u"}kc$�T��[N�Ͳs��x:\L�ؐ�p0N��'�I �X���0.v�tN�Nܑ���v9]�b&W�.�I�E NqxK�w���Hm\C�IO��I��H��>�Ԟ�~���q�һ�6���HB"���k�O5���2���X4�@z��[���, <�\o�N_�+��8:�����`��U�ޘPa���9�v۟1{#�h��k��K�ø��qk<�I�sسv����_[�*�2�7��PV<�.{���. �I�T�C[=�cZ�~%�\����?��ls�N�@����|��y$M���te�1��K���W'��srú|���HI���,�&� K ��%Ҙ��w�����ԌG9�j����^���Õ�y��������Ǧj��C�{�� a�g k����m&�P�����B{�oS:]ȫq�����_��=���Y7��eb��U�Ϟ/d��t��g��&ڥP/)��0_��x��X����Nk lYov9ċ�z!F#�]i��{C��� 9��?/-&P�Na/ U\z�ِM����*�+b��$�x��%��������LM��7\kܤL'��l9��4������K��Sާ��W�R\ )����c`���?GD?�7��+�����-w���C�J��u0��M�t��߰ o8R�FV��U��������u6Ta2��ԣ��JXK֚1����
Behavioral task
behavioral1
Sample
Steam.exe
Resource
win7-20240729-en
General
-
Target
Steam.exe
-
Size
5.9MB
-
MD5
83df4320406c8a4d6a77f47f694d3489
-
SHA1
01e3d49eeec578e954724608f8000463c939ed1a
-
SHA256
a1c193a12ee68ca56f0286ef3b9a221198603e13b0bb207a0554e79de927a951
-
SHA512
d34a01373453ad0e69203ad5f288141cbe514986704eaf388d3d61f50aa75056dc5c16f1cbe0ca0de553d462bed3dc558e9141164e7476a4d83791f886016b61
-
SSDEEP
98304:piEwNGSuhSSjEUE14A3CQTC2tNf+gfdUPYk4OpurnepaphA0FqxzXYTNOJSXRTzE:pINHcjQ+Y3NGgfdUcrn4arOzI5RvgH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Steam.exe
Files
-
Steam.exe.exe windows:6 windows x64 arch:x64
d17038556fe51c27bf7c74a4697768b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
InternetOpenW
kernel32
LocalFree
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 444KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ