N��������:1�5�դ�x7`ԋ���|Y&)o�CD,$���Oԏ��b��"���wHQ4��"f�h-�Q��.�RAKQ�!�Z���(�C�����*��m�r��)��&���d��'�I�"�kйka��e�k�)9,_0�<bχ<�pQ��r���E��J�{K��y�,7��ã3�������4J����������=����K�*��=��ʄ)p>�P��I��I-�)�e�~ʬ��d���� �.����í7���zQ�h�R�ً��â�D�ſ��t��"��R�h����z<�#�9X��CL��.�Y���ͮu�<�B�t��Ѣ`�B9o��mb�b����r�(���~�*�%��|��x����h�N3�p� �J��<���F~q�D�"�Bo4�)]�r���1IWN�F��1�1>�+�td��:S��L�J!z��%��~�nԣ���i�!94���]�WI7�*�f��Yd䤅���u�fy�vN��!�����MRӄ���ov����0���ߟI��ar�>�*��W)T�T&�o�yTU�Hc��չb�*��(��>Oe�<Ċ�U���E���N�f(�6X�DT��6��Ti��x٘u��(��������J�B�k��(���bѩ�/����y��3�t�JC�dQ�BH�X��o�{U��ƀ�zԅ��:П4���6l��� .��i.̹F\ ~ bJ3��qJOҌa3���ע�W&[�Yd��nIx�� �]E�p���V�ԓ�4���~+�G=��ܗ%�C�E����A89� ܦ6,\l���T|e3d��净�l7���Yo+)˱���)�k v`Ĺ$��w���`���U�Ļ�&I���ZAH:��N�)�h<���$�h䩸�T��}�v�+6�o�$���4���#!_ڌ���D�M85L~�x�62z��D#J����=���h:bڌ�τSHv�q��<�j�ZO�z�S#)Fg�K���'��ϐ�� X�ݙ��pO�rv`W�:U���䏙�eBP8�*ypYCh��s\ܗ%����D�"�3���fC�k(e��� ����D���dSidL�o_4��P���[) �ņ�ۯ#(.y_��u��0�A�N��:�����ZM�*�j��9�q;ɿ�Iaʦ�� E���)Eݝ�./&"Z����7jј_�� ( [/���g�!�\�U�&~(�� ���DƊ���A��������4�.cZ���j�R�yE����`>X���x�p�سH!~�ށ�7��ţ�&.kW{F[�I��`QʪY?i_������5���B��c#q�`g?DS��fm� �Ueϳ�AYNB�+��$!�L�`\e6[ZC�����$9�*o�|~=ݸ�\���K�,cv.����H�I�(��������^���0_m�(��Nu�{�PW�f����#о�@�@��ay'<q^y�������`$� ����J����\F[�y�Y��ڷ�fmĮw����a�p�4�/���)߫x���9����$��2WF�3���ߪ�^����8�'�5em��X��)���c��GR�j}���mK�������������x �}��r�4�ē��� wU�}�'�9����~;ӄ �G=-f[6���I9��2���Y�l�`�h\�� ;D����!N\C=��^�" �Z�u�KG��PnY�_��~9/���f,�QQ<xa�BJ<Y,�`�W섘��Vi�C���A�Y��_�jO���1�2������R��������֡��٩x�ǧ�����oQ����Z{X�=j�˔�����D��zxq��� �����J�3M�7��~[Nj.+<�h���O���(k���T��x�jq�&��F�����@��B�t�����<k{C^j���U��tc��f/������ާqI�%�ͧ�U�H������<8]a�T&����>@#&ے��p���XN��JZL�g�Ҽap㞦���V+8�֊�1N�cG^C[�&X���Ԛr��m����������F�<Ny�D�͂l{w���s�DL��$��?�DMB��/��2dk��+��b3�(ê۽f�.�Jl@�Mp������5B{4��R,�U'ŗ#�O>��qx�ׂH����QG\j}U|��_�|�BЩ �oM��R��\���xKY���븸'r�C$lG�?�Q��o�n �������e@�X��ףԅUx|���D��'/7v[�}�E2��!19 Ü M�l}Kl������q@��Q@[,�x ���J����Hn�l�(<� ��[m�M�:�UEJ���3h�շ�o� ��P�av�����b�z�A��˷��t�23�Ñޡ.�|qm�#�����$s��G�>�S����E�Ɵ,9? ����/N��V�g����T^ir8�MN!��!�Kރ� V��f^�"&��A�)Q�ê����̾崉aպ�6N��Η�F�:���:y�����ao����P�����"��;I�=���d�2�E�y]���g����(�oG��dd�C�A�+L�FNh���^`��Ý���?��_5(�EY���cPw_�5밈�*g���P!�դ��]��k[AZ6��5�Ԙ�&�ke������*�C1�r9+o��#p�Gb5�,7R�(T���gTK� ;���lW2^�p���N�.&�3$ xI� ��̎m����L�geR[5��AY��k������ͺ)g��$�,.���d)Ko�7��ݺ�-�4V6EK�\\ʙ��b�é���q����I!�xUK{�%w� �D,7�-� E�;m5� ���{�jC%��k�j��\va���F�����pJ�S��0���@����NIb�G���#�����4/��������z���|j4��8�JL�����U�Q�k��;���_gty��@v�.F;^�<rB- H��#ghd*m��=]U�K�*�����-��\$�p�^7�����>0�3CuA��tP�|q���}xv{C"e�^�pu!(�o�b�7���6/rSH"�H�Q`��v&����*���T
Behavioral task
behavioral1
Sample
SAUCEWAREV2.1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
SAUCEWAREV2.1.exe
Resource
win10v2004-20240508-en
General
-
Target
SAUCEWAREV2.1.exe
-
Size
6.9MB
-
MD5
e9d16d4f3fe1260cf1eea7c6247ea9c9
-
SHA1
462ef85f974643b79aaef0e807db39d2180c7126
-
SHA256
74b90b29012131e775f5ec33e58e817db8edcc00cdf9ead7f89f4ccc306906e5
-
SHA512
63850c616b33a40e9585cae064c66a866b56d056eb9dccf5d3a4194830972d296a832d1a0bec34a79607021c17e9fa9edf52e064dfa66e08e5936a8fe4250d59
-
SSDEEP
196608:Vi+ZSyT0txYgHoN+sjkyDZ0H4EoY1WhACII9cA:Vi+ZSA0tSgIbkyDtEoYAkI93
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SAUCEWAREV2.1.exe
Files
-
SAUCEWAREV2.1.exe.exe windows:6 windows x64 arch:x64
ab3d5cdcedbea56ec14d18bdb62d62d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AllocConsole
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
d3d9
Direct3DCreate9
xinput1_3
ord2
msvcp140
??Bid@locale@std@@QEAA_KXZ
imm32
ImmReleaseContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ