memreduct[.]exe

Resubmissions

20/11/2024, 03:46

241120-eb3ensznbt 3

20/11/2024, 03:44

241120-eas5lszdmh 3

20/11/2024, 03:41

241120-d852ds1ckm 3

Sharing

Copy URL

Twitter E-mail

General

Target

memreduct.exe
Size

302KB
MD5

fe8eb129610e454ad17b9d6ccbf1df8b
SHA1

28cfddbc7faf2e66aee0eec673c7eb7beab25510
SHA256

8cea4adf5febfa9528d01259bf9b70afdb814ce8b41605b8c619a9738a9c9414
SHA512

4aa488a5844eb65fe0f72d1ab325ba07a40fa0cae658bba38f59260c1467d5c902ae8bcd6d8e2f15a5c81139147155948f99a0e303ecca001f24a58d5c5de399
SSDEEP

6144:62uLW2PbSyXuF4a4gLZRE65J3EvgxxEvM:6hBTavRh5J8qxEvM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
memreduct.exe

Files

memreduct.exe
.exe windows:5 windows x64 arch:x64

ba52685fcb3b63a01d6bea3846eea00a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteFileW
GlobalFree
SetFilePointerEx
MoveFileExW
VerSetConditionMask
SystemTimeToFileTime
CreateProcessW
VerifyVersionInfoW
GetSystemTime
CopyFileExW
QueryPerformanceCounter
MulDiv
CompareStringW
MultiByteToWideChar
GlobalMemoryStatusEx
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
LCMapStringW
HeapFree
HeapAlloc
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
ResetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetFileAttributesW
LocalAlloc
FindClose
ExpandEnvironmentStringsW
GetCurrentProcess
GetLongPathNameW
FindNextFileW
CreateDirectoryW
SetDllDirectoryW
FreeLibrary
GetModuleHandleW
GetCurrentProcessId
LocalFree
GetProcAddress
LoadLibraryW
GetCurrentThread
CloseHandle
WaitForSingleObjectEx
TerminateThread
SetEvent
GetLastError
CreateEventW
ResumeThread
ReleaseMutex
GetPrivateProfileSectionNamesW
CreateFileW
GetLocaleInfoW
GetPrivateProfileSectionW
CreateMutexW
GetModuleFileNameW
WriteFile
GetCommandLineW
GetOEMCP
WritePrivateProfileStringW

user32

IsWindowVisible
MonitorFromRect
MonitorFromWindow
EnumChildWindows
GetSysColorBrush
PostQuitMessage
CheckDlgButton
KillTimer
CheckMenuItem
TrackPopupMenuEx
SetCursor
LoadCursorW
TranslateMessage
TranslateAcceleratorW
DrawTextExW
DestroyMenu
GetWindowTextW
EnableWindow
IsDlgButtonChecked
RegisterHotKey
DestroyAcceleratorTable
GetDlgCtrlID
GetMonitorInfoW
SwitchToThisWindow
CreateIconIndirect
DestroyIcon
IsDialogMessageW
SetTimer
DispatchMessageW
LoadAcceleratorsW
GetMenu
PostMessageW
LoadMenuW
GetMessageW
UnregisterHotKey
EndPaint
BeginPaint
ReleaseDC
DialogBoxParamW
RegisterWindowMessageW
GetParent
GetWindowModuleFileNameW
EnableMenuItem
AppendMenuW
GetDlgItem
IsZoomed
GetClientRect
DrawMenuBar
GetClassNameW
SetWindowTextW
SetPropW
GetMenuStringW
EnumWindows
GetSysColor
SendDlgItemMessageW
MapWindowPoints
SetDlgItemTextW
SetMenuItemInfoW
IsWindow
ShowWindow
GetSubMenu
LoadStringW
GetDlgItemTextW
MessageBoxIndirectW
IsWindowEnabled
CharLowerBuffW
SystemParametersInfoW
SetForegroundWindow
LoadImageW
InvalidateRect
IsIconic
GetCursorPos
GetWindowThreadProcessId
CreateDialogParamW
CallWindowProcW
CheckMenuRadioItem
GetWindowRect
DestroyWindow
GetDC
SetWindowPos
GetPropW
SetWindowLongPtrW
DeleteMenu
SendMessageW
EndDialog
GetSystemMetrics
GetWindowLongPtrW

gdi32

BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
GetStockObject
DeleteDC
SetBkMode
GetDeviceCaps
SetPixel
ExtTextOutW
SetBkColor
RoundRect
CreateFontIndirectW
CreateBitmap
CreateSolidBrush
SetTextColor
DeleteObject

comdlg32

ChooseColorW
ChooseFontW

advapi32

RegSetValueExW
GetTokenInformation
RegCloseKey
LookupPrivilegeValueW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
AccessCheck
SetSecurityDescriptorOwner
AllocateAndInitializeSid
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
DuplicateToken
ConvertSidToStringSidW
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
LookupAccountNameW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
SetSecurityDescriptorGroup

shell32

CommandLineToArgvW
ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantClear

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
ord191
PathUnquoteSpacesW
PathFindFileNameW
PathGetDriveNumberW
StrFormatByteSizeW
PathSearchAndQualifyW
ord354

uxtheme

EnableThemeDialogTexture
SetThemeAppProperties
IsThemeActive
SetWindowTheme

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpConnect
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

ntdll

NtQuerySystemInformation
NtSetSystemInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

Sections

.text
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

ba52685fcb3b63a01d6bea3846eea00a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

uxtheme

winhttp

wtsapi32

ntdll

Sections

.text Size: 176KB - Virtual size: 176KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 3KB - Virtual size: 14KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 176KB - Virtual size: 176KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 3KB - Virtual size: 14KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 2KB - Virtual size: 1KB