Overview

overview

10

Static

static

memedora.dll

windows7_x64

memedora.dll

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    memedora.dll

  • Size

    8.6MB

  • Sample

    210117-j1mw7ry68a

  • MD5

    5a0808d43c4f049810a752ebf1298d6c

  • SHA1

    7a08df0595fe3142b4a95391743c09e43feb60e1

  • SHA256

    136732bcc1eb394bab3187dbaa0bb1093d200e1351dae7f8f863c5aa3b07874b

  • SHA512

    7db49ed728b4a740911391f91bfcf4c2cbd96a4c9124d52d4d46065694bd93d2c414c8d77d66ee83aa69f22160169cb67b76c0c290e508917164323e77328103

Score
10/10
bootkitransomware

Malware Config

Targets

    • Target

      memedora.dll

    • Size

      8.6MB

    • MD5

      5a0808d43c4f049810a752ebf1298d6c

    • SHA1

      7a08df0595fe3142b4a95391743c09e43feb60e1

    • SHA256

      136732bcc1eb394bab3187dbaa0bb1093d200e1351dae7f8f863c5aa3b07874b

    • SHA512

      7db49ed728b4a740911391f91bfcf4c2cbd96a4c9124d52d4d46065694bd93d2c414c8d77d66ee83aa69f22160169cb67b76c0c290e508917164323e77328103

    Score
    10/10
    bootkitransomware

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks