c��_����,��l��Y�*��Q@�FT��j��mn%��V�����:Z��t����\sq���@�gk���V�J�g��Ε�ÛU�"��H�g1�|�#������vu@lDT�>0�T���Ei��'���H �g�܆e�9`rF �qS*\�_��*��W7�Qc�U�<���Ұ�ybL:�x��B���L��+d����}��ҩЇ�!�y}[, ֤���������y���);Gg7%���ʀ��S����+��%�h�@�D/d|�v�=�����/:y�ۇdwi]�pD�,X�\3]}�88Pb�.S�u�����0k�c�X����lp(%~k�O/��8�j�8r�&����a�C��V�m.��Nt�z��DI��Ͱ��)�'X�Qs�K�|��@�������W�T_��~Na�Y%�e�4R�T�Rd�^�6+� ��x �(�wr��I�𮏟#���_�L�Z�nsfb�l�]Q�P�9���^!0�櫸B��C��/1��w5��8�������\W�P��������h ���/���Ag�dNis��Iݙ����n���e���㮞 8�%���W �rt�Ӽ~���N���#�v.?nU��h�v�ݥ� �I��vQ��rB�m^���� &�0����bQ��P���h ��d��x�g���xԯ@�Y�Ej��W������ip��d��M3b�)"�.O!�.�8K�b�(u�>� u�� ���T/4F����|��Pj#���/�H���q�&��y�� �@�?���� /{�h�M���<��$���_<���C[���VLe\%Jw��;���L�.轣0B�J�$�h�G�#t=�^�.�����\�v{Bo�˝'�x���<f�0����YũS��]�u��5�6�SUyFQ>�y樋�|��8YW�y68�ɯ0�A��-��Lj��ធ�?�J^;���GZ��\#e',�L(�T�&��=�x��������[��+e,�(������ .y���1�7�1��������bE�Ol��GK�$�w T�IN��c���'���Oضj]�?��غ�����{�d�ث)~H=�N(r�m�b鑛d�!�.�-�~�vҰ c�$�����-p�����.�g�d��h;�,���D�ylq�l��aQ؇xZ��Q����,��� &0�����G��*� �8���&ոY8����?����i���D �u�@�(&������e����SJ\��=� �G�>���bX�C�Q5���'����mH۶����6���?fF]�"MCUz�ݥjӶ߬u�C��V&��%�?jd�aJ.憳�Mb�c�Pc 7P�#�-�mX�L���jk�D�ՅI.��� ��][hU���;L5M_l�@��@M����S�0�zg�x��J��Q����g�9Rt��C3��'���49]i�JB��}�zt�F�}@׳.��!���d�*v��x��qA�����.��!�5�C�� �{� %IUӝ��"mG�>ҍ��9h�D�Z4�S�)��T��n���w�N�B;��ZD)�'�~EXz �^�,��1�ypg���j@m��uD�ջ�iG@��H۾�s�=��7�=�Kaٝ�:� I�{�]�� T}�����7B�6ͫZf�&g���M��@uS����y�q��+��:`P�S��g����w�NN�B��!�H����u絕-D����N0�\��^�_گ+(�J%-�����@�вıl�RN�f�f4sJ�BG�QE]��j�8�N{x2����'xY]����7��/��3� �����%���i��Y=��O�߶5Gj�0B�vY&wNP��L�%-�=.?��c �dm�w��X3��jS�K[Ͳ���,���s��I �U�+�jb<MT��W\� �4�=r�jYE�!�X?F:��M�˙��������-s�-�M�d$*����-M�m��m�3H]�窂�����!��Wc��.L`��z 8����š�_���P�e���~�s�M��ۄ��vH �6��{\]�%��-ʆ۬�~�]2tv5&*��)�\�b@T�'qb��K)Yʕ�OGC� i}OC�> )�Ov�k~;�\��C��cg1`�Ё3Yݧ��s)h�bZ ��Hְ}��l��`@�_�[dK�����;�P3Àߪ�,)�_@ߺRۯ���9 �X����L���9�Y��<%�Z)D��e����:F �A.*�>{��e�C�70}u�s�Ѐ�K�Ў���c�� ���0���y�[�n�a$zt�������c7�3G�����w5@V��QXT"� UB�܌J_���={F������ �����,a`�8ɺb��9Ld��)��'�u[�ܼd~���"M����@n�:�5>2���Y+1�'R�b*�����lVX�_?�0�v^��<���N��%`�~Ҿc�*�<��Ţ�9�ߓ{E���^T�tM�t07�e��i�/�=�E�,>y��ޭOx�ɀH,��e�?gU~�ˠF�ũ�����4թ��i�.�+�á>����c�w������l����1� ���;���%%��)�1����\�������/��ξ?o�/H�J����0�S&��8g�5�A�B�������Cɩl��#�=�� _jP8j2"����mw#O�Ʀ�9�~�����؟��c�5<�#@��Acfrq��kH�y:�I�HG��ʉ�)F~_�Ʀ�2�N�%pc�����t���A�GlD3R}>h�,���<���.c��=�Z��͜X��l�|<E�l`�-j ��]��d����nWqfPJ<i(�sv���"*Z���ie�ͣsŭ.����n),����x�D)����V���H��f���OKØ���)�"�7M�f�5M�y}� ��i�_)����[�iz���� $ ~�F�"��7�u=�>j��*�h�kn�ۈ��&��k�naL|�]F+��V��4����sC�8��[ d�|2���<к�@�U-��d&? �?c�N�0#�-��@�k&R�OCI5Fz�A:)�Yuw$����f�2�#�v6ñ鵷�7��k���D=�
Behavioral task
behavioral1
Sample
mortemsuck.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
mortemsuck.dll
Resource
win11-20240508-en
General
-
Target
mortemsuck.dll
-
Size
5.5MB
-
MD5
76d0869f111f717120806c6bc9fa4bc8
-
SHA1
3441d2a2a14a2431fbc956216a4c2dad205a276a
-
SHA256
b0dac6b9c202a2ad01739dbda54f1b8bc75d3afe018163ccea2985d08b1540ba
-
SHA512
a58a6c1720823b5525403b01b1b8dfce7d8371092627ba1c72675d9500d858d7b81a7b3de6e1c4e2277bcca8ebfaa57fb59b393b0d1f5bc11999839b1bf81a1e
-
SSDEEP
98304:2LXPyWbOPgpz+YGajRmKfbPViarfEQe4xyBqqVQ4LAayNuHTrRy:edOP1OUKjPVprf9e4cgaeuHvRy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mortemsuck.dll
Files
-
mortemsuck.dll.dll windows:6 windows x64 arch:x64
ca072c85de402ad2ed1f58e0306011a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SwapBuffers
opengl32
glGetFloatv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ