Static task
static1
Behavioral task
behavioral1
Sample
MEMZ.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
MEMZ.bat
Resource
win10-20231025-en
Behavioral task
behavioral3
Sample
MEMZ.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
MEMZ.exe
Resource
win7-20231023-en
Behavioral task
behavioral5
Sample
MEMZ.exe
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
MEMZ.exe
Resource
win10v2004-20231023-en
General
-
Target
MEMZ-3.0.zip
-
Size
15KB
-
MD5
a6bef92b14044432f24e6c1a92abb489
-
SHA1
59b5a3d2ea633698cb7d6b4c07523ea6df088828
-
SHA256
c2e850ed1192135ed0cf0720d17c964e5a3bea728c40358b03363e6de8f2af61
-
SHA512
e1628d2e0998ceb294af4788e87507b38c7944425e8de4534354dc8733cafd56a4476a23fea429fb22dd10bb5953d11293325fc9f8ed74b424618fc817d7bc7c
-
SSDEEP
384:ImEVta1lbFaEnonsjoyFsZEVeNJjv/fBob05vzr:I3Vt+lbFFo1yFsZEg3Bp9X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MEMZ.exe
Files
-
MEMZ-3.0.zip.zip
Password: infected
-
MEMZ.bat.bat .vbs
-
MEMZ.exe.exe windows:5 windows x86
02ea6193bc4d1a72912388cc9f90424b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameA
GetCommandLineW
Sleep
SetPriorityClass
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalAlloc
GlobalFree
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
CreateFileA
GetProcAddress
user32
ReleaseDC
GetWindowRect
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumWindows
GetWindow
CallNextHookEx
GetWindowDC
UnhookWindowsHookEx
MessageBoxA
GetSystemMetrics
CreateWindowExA
RegisterClassExA
DefWindowProcA
ExitWindowsEx
DispatchMessageA
TranslateMessage
DrawIcon
SendInput
LoadIconA
SendMessageW
GetMessageA
SetWindowsHookExA
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteA
ShellExecuteExA
winmm
PlaySoundA
psapi
GetProcessImageFileNameA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ