Resubmissions
17-06-2024 03:53
240617-ef1fwashle 715-06-2024 06:53
240615-hnsb1s1fre 715-06-2024 06:47
240615-hkmblavfmk 7Analysis
-
max time kernel
25s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
MEMZ.exe
Resource
win10v2004-20240226-en
General
-
Target
MEMZ.exe
-
Size
16KB
-
MD5
1d5ad9c8d3fee874d0feb8bfac220a11
-
SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595
-
SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
-
SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
SSDEEP
192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4280 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4288 MEMZ.exe 4288 MEMZ.exe 4044 MEMZ.exe 4044 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4044 MEMZ.exe 4560 MEMZ.exe 4044 MEMZ.exe 4560 MEMZ.exe 4288 MEMZ.exe 4280 MEMZ.exe 4288 MEMZ.exe 4280 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4044 MEMZ.exe 4044 MEMZ.exe 1692 MEMZ.exe 1692 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4288 MEMZ.exe 4288 MEMZ.exe 4044 MEMZ.exe 4044 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4280 MEMZ.exe 4288 MEMZ.exe 4280 MEMZ.exe 4288 MEMZ.exe 1692 MEMZ.exe 4044 MEMZ.exe 4044 MEMZ.exe 1692 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4288 MEMZ.exe 4288 MEMZ.exe 4280 MEMZ.exe 4280 MEMZ.exe 4044 MEMZ.exe 4044 MEMZ.exe 1692 MEMZ.exe 1692 MEMZ.exe 4560 MEMZ.exe 4560 MEMZ.exe 4044 MEMZ.exe 1692 MEMZ.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
MEMZ.exedescription pid process target process PID 536 wrote to memory of 4280 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4280 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4280 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4560 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4560 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4560 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4044 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4044 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4044 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4288 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4288 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4288 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 1692 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 1692 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 1692 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4592 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4592 536 MEMZ.exe MEMZ.exe PID 536 wrote to memory of 4592 536 MEMZ.exe MEMZ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵