unpacked[.]mem | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
unpacked.mem
Size 72KB
Sample221013-ty5wmsdbcj
SHA256 b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
MD5 108756f41d114eb93e136ba2feb838d0
SHA1 8c6b51923ee7da2f4642c7717db95fbb77d96164
SHA512 d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
SSDEEP 768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

unpacked.mem

.exe 72KB

unpacked.mem

IMPHASH d99e35e9d4559cb6df0e1eb507b928cc
SHA256 b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
MD5 108756f41d114eb93e136ba2feb838d0
SHA1 8c6b51923ee7da2f4642c7717db95fbb77d96164
SHA512 d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
SSDEEP 768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

21536

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlGetNtVersionNumbers strrchr wcsncmp wcstombs _vsnwprintf wcsstr wcsrchr NtQueryInformationProcess RtlGetCurrentPeb NtYieldExecution vsprintf mbstowcs sprintf _stricmp _chkstk memset memcpy _allrem RtlUnwind

msvcrt

??3@YAXPAX@Z free ??2@YAPAXI@Z malloc

kernel32

GetTempPathW SwitchToThread ExpandEnvironmentStringsW CreateThread DeleteFileA SetFileAttributesW ResumeThread WriteProcessMemory LocalFree DeleteFileW GetWindowsDirectoryW CloseHandle GetFullPathNameW ExitProcess GetCommandLineW GetComputerNameA CreateFileA GetFileSize SetPriorityClass FindFirstFileW SetFilePointer GetLocaleInfoA MapViewOfFile UnmapViewOfFile GetDriveTypeW FreeLibrary HeapAlloc SetUnhandledExceptionFilter InterlockedIncrement MoveFileExW InterlockedDecrement GetCurrentProcess GetLogicalDriveStringsW HeapFree WaitForSingleObject GetSystemDefaultLCID OutputDebugStringW GetTickCount GetProcessHeap FormatMessageA WriteFile InitializeCriticalSection GetSystemDirectoryW Sleep CopyFileW LeaveCriticalSection HeapCreate CreateProcessA ReadFile CreateFileW SetThreadPriority FlushFileBuffers OutputDebugStringA GetFileSizeEx GetLastError GetProcAddress QueueUserAPC MoveFileW EnterCriticalSection VirtualAllocEx FindClose GetLocalTime LoadLibraryA CreateFileMappingA LocalAlloc DeviceIoControl WaitForMultipleObjects GetModuleFileNameA GetModuleHandleA FindNextFileW GetShortPathNameW

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

ws2_32

WSAStartup connect send gethostbyname closesocket socket htons

user32

MessageBoxA wsprintfW

advapi32

GetUserNameA RegSetValueExW RegCloseKey GetCurrentHwProfileW RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA

shell32

CommandLineToArgvW