lazepro[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lazepro.exe
Size 10.2MB
Sample260729-ymd11adh96
SHA256 09c46d72cd7c0baac1b50d73f7bd236d8ed4716652c44a51afdd1125487f86a9
MD5 0e1ff3318283f08b2e19bba2b0c151be
SHA1 3bd28c9471be00b150f7a617c290d19dd902a243
SHA512 9d8428119362446a048ed171ea352b7dd5bb1a7c255beb64b106bdfdcd540507bce3ecaedde92fce056c7debc112c0646334a1c1dd4666f96dc9b088e4199ecc
SSDEEP 196608:mzMikyKd9cE65PBWlp5gVxwYmqby46vrFcKf8PpTK91Vd8sBe7124WKp0z:mzGSPg5gVxN27jEJ+1L5S1fpO
TLSH
T1E7B623EA2C8141DCC7529A38D29715EBF3993D518DBA4E1A2FC6D5432DB2C00E49BE7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lazepro.exe

File Explorer

lazepro.exe

.exe 10.2MB

lazepro.exe

IMPHASH acea35cc71607f15a0d25d411372c432
SHA256 09c46d72cd7c0baac1b50d73f7bd236d8ed4716652c44a51afdd1125487f86a9
MD5 0e1ff3318283f08b2e19bba2b0c151be
SHA1 3bd28c9471be00b150f7a617c290d19dd902a243
SHA512 9d8428119362446a048ed171ea352b7dd5bb1a7c255beb64b106bdfdcd540507bce3ecaedde92fce056c7debc112c0646334a1c1dd4666f96dc9b088e4199ecc
SSDEEP 196608:mzMikyKd9cE65PBWlp5gVxwYmqby46vrFcKf8PpTK91Vd8sBe7124WKp0z:mzGSPg5gVxN27jEJ+1L5S1fpO
TLSH
T1E7B623EA2C8141DCC7529A38D29715EBF3993D518DBA4E1A2FC6D5432DB2C00E49BE7C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35110047

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess CreateWaitableTimerW VirtualAlloc GetProcessId GetEnvironmentVariableW WaitForSingleObject GetFileAttributesW GetSystemDirectoryW CancelWaitableTimer CreateToolhelp32Snapshot MultiByteToWideChar Sleep K32GetModuleFileNameExA GetLastError Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread LoadLibraryA QueryPerformanceFrequency DeleteFileW Process32FirstW CloseHandle GetThreadContext GetProcAddress VirtualAllocEx ReadProcessMemory GetModuleHandleW WideCharToMultiByte CreateRemoteThread CreateProcessA VirtualFreeEx CreateWaitableTimerExW QueryPerformanceCounter MulDiv IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA IsDBCSLeadByte VerSetConditionMask FreeLibrary RtlUnwind VirtualFree InitializeCriticalSection FindNextFileA FindFirstFileA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation OutputDebugStringW GetCurrentDirectoryW SetEndOfFile SetStdHandle HeapReAlloc ReadConsoleW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree FlushFileBuffers HeapAlloc SetFilePointerEx GetFileSizeEx ExitProcess WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteFile SetWaitableTimer WriteProcessMemory CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetFileType ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateFileW GetFullPathNameW MoveFileExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx WaitForSingleObjectEx CreateThread GetEnvironmentVariableA SetLastError VerifyVersionInfoW FormatMessageA InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapSize ReadFile

user32

PtInRect MsgWaitForMultipleObjectsEx ReleaseDC SetForegroundWindow UpdateWindow GetClientRect GetKeyState GetMessageExtraInfo LoadCursorA GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW AdjustWindowRectEx PostMessageW GetWindowRect DestroyWindow GetDC SetWindowPos MessageBoxW MonitorFromWindow CreateWindowExW ScreenToClient SendMessageW UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW GetMonitorInfoW PeekMessageW SetWindowsHookExW UnhookWindowsHookEx EnumWindows TranslateMessage PostQuitMessage

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError htons recvfrom ntohs WSAStartup WSACleanup accept bind closesocket connect getpeername getsockname recv setsockopt socket WSASetLastError WSAIoctl __WSAFDIsSet select htonl listen getaddrinfo freeaddrinfo ioctlsocket inet_pton

Name

.text

Size

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

20.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

10.2MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lazepro.exe

kernel32

user32

ws2_32

generic