ǵ%(�26�bU�O7Ӡ�1����@�-E6��,�Ě>Cu2�����ٯJ �� �Y��j�[8������:!��$qϴ��M����K��ǪL��#V��g{[��3����=i �j���7�q��7CO���8I{2sY�!��U�����ʟ>�u=��p��ty0r����W5�@m�w��ߚ����K������,Ȩ��<d&��~������!s�&W���[�_uo���Fۿ�/�[�U�5$X-J�z�Ç�lW549�W��th�2C���7�F�m1竓���UD�-�wS�f����ob��~�e�r^���R �����>>�M@̊5���X�Δ' �p���p�����Y����A�M.j�\HQ`m\+z���pHY���!�)��fD]�|����QGv<� |W9���d!{Ы8q�\eϽ����!��"����=������P]+�]^W�������\�'d�إk/���*���F�''����dW��)�N)N9��z�%b2�{,c�?���(O�Û a��%&�]�.H�u�C'�2�����T�ͱҴ!���w�4�%{`Ʋ3���m���@ ��/G�A�8��b�G��Re���>���>��ik���M�6,'s����[���P���|�����ܘk1���(�'�P��F���f()ڥF@i��M%W(�f�-b"O2��X7���=K1+�l��m�*Ŵdɼ9I6���+d�Ye⢵L{/��gOJ4P_t��1���<�;�T�>�r=eBB[��c9��4����Z���*l��u�_���yHpC�z^���&�K�����#�WPK.��ǜ���fSV���ŗ��ˠ�)�`*� �������x_�^�d���xy̔��U�>.}s?��എ�&1"�m��)�/�D�K����Қ �@ҏe�^z�͎���i��/'�)�I���iE������.��vVb��Lq�����dbF��`|Ív8���@��}�� J>�P�dZ\d�Ō�x� �|lr���G-®�V�s0����aM��������pX��d�Hi�"��>,�}���¦&� �e>v�b�rJ4u��o�4ģy|Px����a�V��|�7�p�������_�R�D�S������B��3�F/����j2�CA8�y��$C�����3zϚ����g������i��*P�2Y١����߽Fm�S��m�WGe�t���e�|��f�RAdcL�[��zr���G��TA�F 3��Mb�R����Mt� hƎ�<���`��6G�RF����Y�,=H�0�]P=ɉ������5�9�u{8D��+xu�Pn�Ԇ@�cl��F~�����s��Wd�ZrĈP��P;����z��o͝"˳hxp�K�@�[n5/�����Pߌ e|�*-���ޓ�����XOS�[&p�s�AĶ����I���(��v@Y�O��-��^V���U�2M�N�-�����L�-��~� ��o���BGH���J��q+ Sh�٬ 9Ao=f]�@,�O,~�;B�7��I��L�TL��K/z!�Q���sP����n��0�va��m�����'@��/C�������fOJ���k�6�W���nrR���c ���,��m����5���x��s��vm���q����Xp�_�D��uT�)m�� ���My�}���\?~���||��P��bb�Ш�ki2%T����{�i�^�a<����?Ϭ������~��v��~�M�����I���:W�z�w:�M0o�[�?w�����{ �j�����#��̼� �Y��5#�e�sQ?�8�%��5�v�j��>��N� �<��n���� �����p`-����|T�G�+�^�)�#���p���ۤE�_��j�>�������1(r���+s�d/��B�,��~�i���Ӥ�� �yp�8�<I��a�tշ�-%�B����6��\?o��j��ᾭ��N&=ԠE-�����EZ�D��)$b.B����c�np��5 ���� i�C�� ��Fz���#�uŇII&@N�y�4�l��A?v�9E}�#2d9/�Ev&�)�a볧��61���`,wz�d�>� 6�>K�ج�k��̣*/ߛ�e/����k����~C�T���ia�u���j{�~^pFx���}�����U�����j{�jԥ��r�%�N���:m8t�-��}��܉��1�Ӥ���ۘ��,��|��I�v4�&�N�o�P����\N��V�������ѐ{@�m�x���غIW�$/ �n�����BCNq�=���w���,���{X�<�N�"3���sO~ �9�ױ9��c�;�|da�X�oGQ���f+�H�S�M(X�ѷ�B���*O�i���-J�Wd�3ډ������b����tW��1���vr7 ~'���#^�JC�*Me����6g�H�H��}�>�L�!��Jb�X��pĊF��&V���B�a�k�4f4�L��Ň��/�GO9�"y���'o_w�-;Wl`@ܢM���c���~���h*���;�����b'^�_��s胠,�� c���&���3[! ؍ k�]�25�{5��Oi�� 7} j�i�N�S��$� @0�ւ��e��X�ک��N���un��~���0��#J�\�0'������5]���0;� �����(I8�D$�z&2��R�>��g/��A��tz���x�5+��?�-Q�Fuc D�ŵ�_����w����U�;���>�1f�1�/̸*oh�r\�sk ���7��|T䰻dlO<��nj�c�6�o�N�� ��D�~�q1Fb�-"�`2�͂�Vu?N�Z;�4�X���!�U$#��L�[,�ޒ`q�eR}������}#A��l[���3�l� o��G�����w��}¸���?���< W�-E|�����!��V? ���'��O�C�,� ��V}�K1�����;���e>�(gA����Aj��I�ϸ��isT����@�=�sg����������Q-�
Behavioral task
behavioral1
Sample
susamongus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
susamongus.exe
Resource
win10v2004-20240226-en
General
-
Target
susamongus.exe
-
Size
5.5MB
-
MD5
c4e6d24f172d1218d3e76dac41f45abc
-
SHA1
d64c6657ea1887a3d5754d78cbb40c24cce517ab
-
SHA256
822119c506ff7189dc1486f2ccaf5b020dceaa02175fb333065ade84c3b94872
-
SHA512
7ef275faa9d28a48dd5b0441f3717b9a36abd0d8c0a4afcd5b143adedd368dbeae7d886e08f1aace0c5d9aec9857d49bc5b5ecfde8689d0afafcf8d293ed5269
-
SSDEEP
98304:S6ZeckyKWcPyVrgX3lY7XlmRXhTLYGpVZ8I9pOh3D/+7m3hccLKckkQ3mYinSQ1O:BeelcqV0X3lYbkRR5HbulD/KmJWHNWJa
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource susamongus.exe
Files
-
susamongus.exe.exe windows:6 windows x64 arch:x64
e37dbb086a77cde66419329278c9f35f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
GlobalLock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCompositionWindow
xinput1_3
ord2
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ