Analysis
-
max time kernel
18s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:52
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ-master/MEMZ.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MEMZ-master/MEMZ.exe
Resource
win10v2004-20220414-en
General
-
Target
MEMZ-master/MEMZ.exe
-
Size
16KB
-
MD5
1d5ad9c8d3fee874d0feb8bfac220a11
-
SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595
-
SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
-
SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4592 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 4496 MEMZ.exe 4592 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 1156 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 1156 MEMZ.exe 1156 MEMZ.exe 1156 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 2316 MEMZ.exe 1156 MEMZ.exe 1156 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 4592 MEMZ.exe 5068 MEMZ.exe 5068 MEMZ.exe 1156 MEMZ.exe 1156 MEMZ.exe 2316 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 2316 MEMZ.exe 1156 MEMZ.exe 1156 MEMZ.exe 5068 MEMZ.exe 4592 MEMZ.exe 5068 MEMZ.exe 4592 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 2316 MEMZ.exe 4592 MEMZ.exe 5068 MEMZ.exe 1156 MEMZ.exe 4496 MEMZ.exe 4496 MEMZ.exe 1156 MEMZ.exe 2316 MEMZ.exe 5068 MEMZ.exe 4592 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 1156 MEMZ.exe 4496 MEMZ.exe 5068 MEMZ.exe 2316 MEMZ.exe 4592 MEMZ.exe 4496 MEMZ.exe 5068 MEMZ.exe 1156 MEMZ.exe 4592 MEMZ.exe 5068 MEMZ.exe 4496 MEMZ.exe 2316 MEMZ.exe 1156 MEMZ.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
MEMZ.exeMEMZ.exedescription pid process target process PID 1640 wrote to memory of 4592 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 4592 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 4592 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 4496 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 4496 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 4496 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 2316 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 2316 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 2316 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1156 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1156 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1156 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 5068 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 5068 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 5068 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1164 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1164 1640 MEMZ.exe MEMZ.exe PID 1640 wrote to memory of 1164 1640 MEMZ.exe MEMZ.exe PID 1164 wrote to memory of 1172 1164 MEMZ.exe notepad.exe PID 1164 wrote to memory of 1172 1164 MEMZ.exe notepad.exe PID 1164 wrote to memory of 1172 1164 MEMZ.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ-master\MEMZ.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-133-0x0000000000000000-mapping.dmp
-
memory/1164-135-0x0000000000000000-mapping.dmp
-
memory/1172-136-0x0000000000000000-mapping.dmp
-
memory/2316-132-0x0000000000000000-mapping.dmp
-
memory/4496-131-0x0000000000000000-mapping.dmp
-
memory/4592-130-0x0000000000000000-mapping.dmp
-
memory/5068-134-0x0000000000000000-mapping.dmp