Memorysense[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Memorysense.exe
Size 933KB
Sample260820-3bva3axcmb
SHA256 214973dfe9f883098d34456a91268bcc480c6119e1d1c1dd48d04a5fe4d0a029
MD5 5995bc5e1c65208751f5bac18ded86fc
SHA1 c69858b8dc70c6da8005159a5ea30acb67211be4
SHA512 d789762e5240ce346912a9f17e306be91615adda42f344174cc0aa5429e1d2328a16d4cd908312f6a02bf0a3870d5a16787d7943488043330974c2e97c4a3c18
SSDEEP 24576:KKuSi0PiEHa5irq6e8M7LOk1nqMJbUsE:KKuS/PiEHaYo8uLOkNNtUsE
TLSH
T14F15CF42B2E545EDC07BF036E156722BFA753869032156EB33D4096CBF966E06FBA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Memorysense.exe

File Explorer

Memorysense.exe

.exe 933KB

Memorysense.exe

IMPHASH baa31982061134d2047ad0cd194a91ae
SHA256 214973dfe9f883098d34456a91268bcc480c6119e1d1c1dd48d04a5fe4d0a029
MD5 5995bc5e1c65208751f5bac18ded86fc
SHA1 c69858b8dc70c6da8005159a5ea30acb67211be4
SHA512 d789762e5240ce346912a9f17e306be91615adda42f344174cc0aa5429e1d2328a16d4cd908312f6a02bf0a3870d5a16787d7943488043330974c2e97c4a3c18
SSDEEP 24576:KKuSi0PiEHa5irq6e8M7LOk1nqMJbUsE:KKuS/PiEHaYo8uLOkNNtUsE
TLSH
T14F15CF42B2E545EDC07BF036E156722BFA753869032156EB33D4096CBF966E06FBA301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

556076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\harpset\Downloads\illsueanysourcestealers\SueHeckSense\Memorysense\build\Memorysense.pdb

d3d11

D3D11CreateDeviceAndSwapChain

freetype

FT_Request_Size FT_New_Memory_Face FT_GlyphSlot_Oblique FT_New_Library FT_Render_Glyph FT_GlyphSlot_Embolden FT_Done_Face FT_Select_Charmap FT_Get_Char_Index FT_Done_Library FT_Add_Default_Modules FT_Load_Glyph

kernel32

AcquireSRWLockExclusive ReleaseSRWLockExclusive UnhandledExceptionFilter GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SetConsoleTextAttribute GetStdHandle SetConsoleTitleA Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle RtlLookupFunctionEntry SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent SleepConditionVariableSRW Sleep GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetCurrentThreadId RtlCaptureContext WakeAllConditionVariable RtlVirtualUnwind

user32

SetWindowLongA MoveWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes PeekMessageA GetWindowLongPtrA UnregisterClassA PostQuitMessage SetWindowLongPtrA RegisterClassExA UpdateWindow IsIconic ShowWindow DispatchMessageA TranslateMessage FindWindowA SendInput OpenClipboard CloseClipboard EmptyClipboard GetSystemMetrics GetAsyncKeyState GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA DestroyWindow GetMessageA GetCursorPos SetCursorPos ReleaseCapture GetKeyboardLayout IsWindowUnicode GetClientRect SetCursor SetCapture ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Xtime_get_ticks ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Xout_of_range@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

wininet

InternetCloseHandle InternetOpenA

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context _CxxThrowException __current_exception __C_specific_handler memset __std_exception_destroy __std_exception_copy __std_terminate strstr memchr memcmp memcpy memmove

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _invoke_watson _get_initial_narrow_environment _initterm _initterm_e exit _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _beginthreadex

api-ms-win-crt-math-l1-1-0

floorf acosf atan2f fmodf ceilf logf pow roundf nearbyint log sinf cosf __setusermatherr sqrtf fmaxf fminf powf

api-ms-win-crt-string-l1-1-0

strcmp tolower isalnum strncmp _stricmp isdigit strncpy strcpy_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode ftell _set_fmode fflush fclose __stdio_common_vsprintf_s __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fseek __stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale