memstreamproof[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
memstreamproof.exe
Size 3.6MB
Sample260731-p5krtstdka
SHA256 8552f50c81caed855492c92a1ce6a1cdbe1159f65c9c9f363dda6e71a798fc70
MD5 81c839db1dde4ae636c9bd1def678903
SHA1 e4b993650ac163ca941871858a99e0c4231ff7e8
SHA512 a25ac601be109e4af89123aeeca42b11b5c6251435e84b9f58a51854a26b19a1b136faf471d7c17707ddffa2b07c8a059df709f54e959d4d0a8352b7a3fd11ba
SSDEEP 49152:INtogDnOnkIC8uUv6nzGnXQqhjW4ERbSduglHNvRN8wx:kgtv6IKuzF5x
TLSH
T1FB06CF27B3A541E8C467E5389A91E72BF77138040B30A3DB27E04E555FA76E01EBBB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
memstreamproof.exe

File Explorer

memstreamproof.exe

.exe 3.6MB

memstreamproof.exe

IMPHASH dc94419a1d632f621e48b370b2cfbadb
SHA256 8552f50c81caed855492c92a1ce6a1cdbe1159f65c9c9f363dda6e71a798fc70
MD5 81c839db1dde4ae636c9bd1def678903
SHA1 e4b993650ac163ca941871858a99e0c4231ff7e8
SHA512 a25ac601be109e4af89123aeeca42b11b5c6251435e84b9f58a51854a26b19a1b136faf471d7c17707ddffa2b07c8a059df709f54e959d4d0a8352b7a3fd11ba
SSDEEP 49152:INtogDnOnkIC8uUv6nzGnXQqhjW4ERbSduglHNvRN8wx:kgtv6IKuzF5x
TLSH
T1FB06CF27B3A541E8C467E5389A91E72BF77138040B30A3DB27E04E555FA76E01EBBB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1830036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc ReadProcessMemory GetProcessHeap CreateProcessW GetModuleHandleW VirtualQueryEx SetPriorityClass TerminateProcess CreateThread GetCurrentProcessId SetThreadExecutionState WriteProcessMemory GetTickCount64 VirtualProtectEx SetThreadAffinityMask Sleep SwitchToThread QueryFullProcessImageNameW VirtualAllocEx GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Module32Next GetProcessId Module32First DuplicateHandle Process32FirstW GetSystemInfo GetCurrentThread InitOnceBeginInitialize InitOnceComplete AcquireSRWLockShared ReleaseSRWLockShared GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile ReadFile GetFileSizeEx CreateFileA LoadLibraryW GetVolumeInformationA CloseHandle Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess WaitForSingleObject SetThreadPriority VirtualAlloc GetCurrentProcess VirtualFree HeapFree VirtualProtect GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetConsoleWindow GetModuleHandleA

user32

EmptyClipboard ClientToScreen CloseClipboard SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetClipboardData OpenClipboard TrackMouseEvent wsprintfA GetDesktopWindow ShowCursor keybd_event MapVirtualKeyA GetWindowThreadProcessId GetClassNameA GetCapture GetGUIThreadInfo SendInput DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow EnumDisplayMonitors CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow IsWindow GetAsyncKeyState GetMonitorInfoW SetWindowLongA SetWindowDisplayAffinity GetDC ScreenToClient GetMonitorInfoA MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA GetWindowTextA ReleaseDC PostQuitMessage FindWindowA UpdateWindow GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos MonitorFromWindow

gdi32

GetDeviceCaps CreateSolidBrush

advapi32

LookupPrivilegeValueA RegQueryValueExA RegOpenKeyExA AdjustTokenPrivileges RegCloseKey RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW OpenProcessToken RegDeleteTreeW OpenSCManagerA CloseServiceHandle

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysFreeString SysAllocString

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

msvcp140

?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Cnd_broadcast _Thrd_join _Thrd_id ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Thrd_detach ??0task_continuation_context@Concurrency@@AEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter

iphlpapi

FlushIpNetTable GetIfTable

winhttp

WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpSetTimeouts WinHttpSendRequest WinHttpConnect WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

winmm

timeGetTime timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset __std_terminate strstr strchr __std_exception_destroy __std_exception_copy __C_specific_handler _purecall strrchr longjmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

fseek fclose _set_fmode __acrt_iob_func ftell __stdio_common_vsprintf_s __stdio_common_vfprintf fwrite _wfopen __stdio_common_vsprintf __p__commode fread __stdio_common_vsscanf fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

towlower toupper strncmp strcmp _stricmp _wcsicmp strcpy_s tolower strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh realloc free malloc

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoull strtoll strtol atof

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _beginthreadex terminate _errno abort _crt_atexit _seh_filter_exe _set_app_type _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e _exit _initialize_onexit_table _cexit _c_exit _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-math-l1-1-0

pow ceilf logf log atan2f fmodf acosf _fdclass roundf __setusermatherr _dclass _dsign powf cosf sinf sqrt ldexp sqrtf

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv