Overview

overview

7

Static

static

3

memreduct-...up.exe

windows10-2004-x64

7

memreduct-...up.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.bmp

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

memreduct.exe

windows10-2004-x64

6

memreduct.exe

windows11-ltsc_2024-x64

6

memreduct.exe.sig

windows10-2004-x64

3

memreduct.exe.sig

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    memreduct-3.5.2-setup.exe
  • Size 372KB
  • Sample260817-bl69ts1vgv
  • SHA256 025e5c06f7beccf5c85cbe931bc058f53a4642ca83a00855a475026a5e6334c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistence

Malware Config

Targets

    • Target
      memreduct-3.5.2-setup.exe
    • Size 372KB
    • SHA256 025e5c06f7beccf5c85cbe931bc058f53a4642ca83a00855a475026a5e6334c4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/modern-header.bmp
    • Size 25KB
    • SHA256 b74ed1397c5a50c22ddd4da1c01cf1a36484fa38623051b4959bb6e01d657547
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 150KB
    • SHA256 411961864a8edb7cc2ba384e702bbb787040ea47488d2cefc2ef2c6f0a55a832
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      memreduct.exe
    • Size 387KB
    • SHA256 dd55a81d56e8c32918e5190b2ec2a1f2a7edbbca884627439b4b619fdfb5602d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    persistence

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral11behavioral12
    • Target
      memreduct.exe.sig
    • Size 566B
    • SHA256 3152dde222deb493a3e56e41014f9ba7340393b0aa2a7f61615228a4c0af560e
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Tasks