Remember[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Remember.exe
Size 231.9MB
Sample260712-ktrnsae14p
SHA256 1918b63fe28ffd4a8497f1ebc5bb784ce0f990e6f598c44e470ba31a48e8bd35
MD5 4e4d2c9d6ee89ffe907f6bcd1c4241fb
SHA1 e388fb348f0eadb1e020ccadcb41433bd536ad1e
SHA512 5697d2c0b7f042a023a7fcaa9b3f908a6fb8199e97c89512ef6346aac05572507946d5e9d2f81225c32daa419634284c0e070d80950be62adb6c3123235fed68
SSDEEP 6291456:FUwtDAEkxuYTmZaDWSlEfAEdzBwLsnlLPTe0tzulgiIILJGOxOCmLrx2OHj6nVhg:F3KmIFJvp5GZnLU4
TLSH
T12BC808EA260E413AC339BA3042672121D8B56F174D793BA737BCFFA60F731513658968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Remember.exe

File Explorer

Remember.exe

.exe 231.9MB

Remember.exe

IMPHASH 242fe97ea0069b4948c1646b5b2c52c8
SHA256 1918b63fe28ffd4a8497f1ebc5bb784ce0f990e6f598c44e470ba31a48e8bd35
MD5 4e4d2c9d6ee89ffe907f6bcd1c4241fb
SHA1 e388fb348f0eadb1e020ccadcb41433bd536ad1e
SHA512 5697d2c0b7f042a023a7fcaa9b3f908a6fb8199e97c89512ef6346aac05572507946d5e9d2f81225c32daa419634284c0e070d80950be62adb6c3123235fed68
SSDEEP 6291456:FUwtDAEkxuYTmZaDWSlEfAEdzBwLsnlLPTe0tzulgiIILJGOxOCmLrx2OHj6nVhg:F3KmIFJvp5GZnLU4
TLSH
T12BC808EA260E413AC339BA3042672121D8B56F174D793BA737BCFFA60F731513658968
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

RaiseException CompareStringW CompareStringA FlushFileBuffers WaitForSingleObject CreateFileMappingA CloseHandle UnmapViewOfFile GlobalFree GlobalAlloc MapViewOfFile OpenFileMappingA OpenMutexA DeleteFileA RemoveDirectoryA WritePrivateProfileStringA CreateFileA GetWindowsDirectoryA GetTempPathA GetModuleFileNameA WriteFile ReadFile GetFileSize FreeLibrary GlobalUnlock GlobalSize GlobalLock GetProcAddress LoadLibraryA FindFirstFileA GetSystemDirectoryA WideCharToMultiByte VirtualFree VirtualAlloc GetVersionExA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetTimeZoneInformation VirtualQuery GetModuleFileNameW GetProcessHeap HeapReAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetLastError FindNextFileA GetDriveTypeA GetFullPathNameA GetLocalTime SetEnvironmentVariableA GetCurrentDirectoryA SetCurrentDirectoryA RtlUnwind GetCommandLineA GetStartupInfoA HeapAlloc CreateDirectoryA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DebugBreak MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree Sleep GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetModuleHandleA GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime

user32

wsprintfA MessageBoxA DefWindowProcA PostQuitMessage LoadIconA DestroyWindow ShowCursor LoadCursorA SetCursor RegisterClassA CreateWindowExA ShowWindow SetWindowLongA SetWindowPos UpdateWindow

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantInit VariantClear SysStringLen