Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230221-es
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20230220-es
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-es
General
-
Target
MEMZ 3.0.zip.zip
-
Size
16KB
-
MD5
7c423354cde6e57b90f290e75d6fb536
-
SHA1
14c490bc51313bacad31afea716fa9c21469a40d
-
SHA256
266d55fa5a8cee9d08c93c10f06cd75b8c2a7cd181933f9f955cc4e1333b5475
-
SHA512
40e2ea0f901cd501aca7b6fe7f6b89f343547940045ba634edd021a4391117bd820cc919f61984c97a1610d8bdd9ad456c3d63f9b13510a410f125634141d21d
-
SSDEEP
384:beWfD0Z8KHI8+EjtxPArykp2abxWcG2ABHxjnmvwf3o:bPfD1KHjtEwcJ4zmk3o
Malware Config
Signatures
Files
-
MEMZ 3.0.zip.zip.zip
Password: infected
-
MEMZ 3.0.zip.zip
-
MEMZ 3.0/MEMZ.bat.bat .vbs
-
MEMZ 3.0/MEMZ.exe.exe windows x86
02ea6193bc4d1a72912388cc9f90424b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameA
GetCommandLineW
Sleep
SetPriorityClass
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalAlloc
GlobalFree
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
CreateFileA
GetProcAddress
user32
ReleaseDC
GetWindowRect
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumWindows
GetWindow
CallNextHookEx
GetWindowDC
UnhookWindowsHookEx
MessageBoxA
GetSystemMetrics
CreateWindowExA
RegisterClassExA
DefWindowProcA
ExitWindowsEx
DispatchMessageA
TranslateMessage
DrawIcon
SendInput
LoadIconA
SendMessageW
GetMessageA
SetWindowsHookExA
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteA
ShellExecuteExA
winmm
PlaySoundA
psapi
GetProcessImageFileNameA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ