memnostreamproof[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
memnostreamproof.exe
Size 3.6MB
Sample260731-pybwcatxcw
SHA256 69ff6978b9ac3c0cad72e9b32347c734a98aef09b00189b941529621ff353da2
MD5 f884ccf0ec850484b69141729f9b841d
SHA1 6f52a07f9ece5cda672ac38a01ceaae6a2258f9b
SHA512 605eaf217711b1f2472dd18aa83271b80edd0ccf1f20fc41353eccc2def54d0d89cfed37c2e372c53838996a9007c8c940ef846ed1db7c9078a7504d573882cc
SSDEEP 49152:INtfgDnO+kIC8uUv6nzGnXQqhjW4ERbSduglHNvRN8wx:rNtv6IKuzF5x
TLSH
T1F106CF27B3A541E8C467E5389A91E72BF77138040B30A3DB27E04E555FA76E01EBBB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
memnostreamproof.exe

File Explorer

memnostreamproof.exe

.exe 3.6MB

memnostreamproof.exe

IMPHASH dc94419a1d632f621e48b370b2cfbadb
SHA256 69ff6978b9ac3c0cad72e9b32347c734a98aef09b00189b941529621ff353da2
MD5 f884ccf0ec850484b69141729f9b841d
SHA1 6f52a07f9ece5cda672ac38a01ceaae6a2258f9b
SHA512 605eaf217711b1f2472dd18aa83271b80edd0ccf1f20fc41353eccc2def54d0d89cfed37c2e372c53838996a9007c8c940ef846ed1db7c9078a7504d573882cc
SSDEEP 49152:INtfgDnO+kIC8uUv6nzGnXQqhjW4ERbSduglHNvRN8wx:rNtv6IKuzF5x
TLSH
T1F106CF27B3A541E8C467E5389A91E72BF77138040B30A3DB27E04E555FA76E01EBBB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1830036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc ReadProcessMemory GetProcessHeap CreateProcessW GetModuleHandleW VirtualQueryEx SetPriorityClass TerminateProcess CreateThread GetCurrentProcessId SetThreadExecutionState WriteProcessMemory GetTickCount64 VirtualProtectEx SetThreadAffinityMask Sleep SwitchToThread QueryFullProcessImageNameW VirtualAllocEx GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Module32Next GetProcessId Module32First DuplicateHandle Process32FirstW GetSystemInfo GetCurrentThread InitOnceBeginInitialize InitOnceComplete AcquireSRWLockShared ReleaseSRWLockShared GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile ReadFile GetFileSizeEx CreateFileA LoadLibraryW GetVolumeInformationA CloseHandle Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess WaitForSingleObject SetThreadPriority VirtualAlloc GetCurrentProcess VirtualFree HeapFree VirtualProtect GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetConsoleWindow GetModuleHandleA

user32

EmptyClipboard ClientToScreen CloseClipboard SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetClipboardData OpenClipboard TrackMouseEvent wsprintfA GetDesktopWindow ShowCursor keybd_event MapVirtualKeyA GetWindowThreadProcessId GetClassNameA GetCapture GetGUIThreadInfo SendInput DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow EnumDisplayMonitors CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow IsWindow GetAsyncKeyState GetMonitorInfoW SetWindowLongA SetWindowDisplayAffinity GetDC ScreenToClient GetMonitorInfoA MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA GetWindowTextA ReleaseDC PostQuitMessage FindWindowA UpdateWindow GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos MonitorFromWindow

gdi32

GetDeviceCaps CreateSolidBrush

advapi32

LookupPrivilegeValueA RegQueryValueExA RegOpenKeyExA AdjustTokenPrivileges RegCloseKey RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW OpenProcessToken RegDeleteTreeW OpenSCManagerA CloseServiceHandle

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysFreeString SysAllocString

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

msvcp140

?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ?_Xinvalid_argument@std@@YAXPEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Cnd_broadcast _Thrd_join _Thrd_id ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Thrd_detach ??0task_continuation_context@Concurrency@@AEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter

iphlpapi

FlushIpNetTable GetIfTable

winhttp

WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpSetTimeouts WinHttpSendRequest WinHttpConnect WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

winmm

timeGetTime timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset __std_terminate strstr strchr __std_exception_destroy __std_exception_copy __C_specific_handler _purecall strrchr longjmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

fseek fclose _set_fmode __acrt_iob_func ftell __stdio_common_vsprintf_s __stdio_common_vfprintf fwrite _wfopen __stdio_common_vsprintf __p__commode fread __stdio_common_vsscanf fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

towlower toupper strncmp strcmp _stricmp _wcsicmp strcpy_s tolower strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh realloc free malloc

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoull strtoll strtol atof

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _beginthreadex terminate _errno abort _crt_atexit _seh_filter_exe _set_app_type _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e _exit _initialize_onexit_table _cexit _c_exit _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-math-l1-1-0

pow ceilf logf log atan2f fmodf acosf _fdclass roundf __setusermatherr _dclass _dsign powf cosf sinf sqrt ldexp sqrtf

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv