Memesense CS2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Memesense CS2.exe
Size 125KB
Sample260918-getytassaz
SHA256 2b296bf4753f82ce8d311cc1de3c2e1adda32b309a060eddb7ae110d434c2ab9
MD5 d668066ee28bb15e4d1cb50eefa0185c
SHA1 b7498b5a5b235ee1eafc5973225616b89fb94739
SHA512 ad5260ec49bf53c06c2718fb66e0f5deb600b9e490c18d1dd4c4ab92f2a9ba434e9aa41c5ec72fae9de2b981d209ecf4f2e7a35a6780a971322bc58f01c69496
SSDEEP 3072:P1dVLvrc+VoekegD3wrLRlW3etAYJC0MJ:P1dVDrc+VoekeQgr1lW3esDJ
TLSH
T1D0C3AF34DA1AB06FD35E9874DA031D06CE62BCCA46A0BBCB57914CD20EE5F60DB2D781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Memesense CS2.exe

File Explorer

Memesense CS2.exe

.exe 125KB

Memesense CS2.exe

IMPHASH 838ebf00106c790e199157fb51d61b1e
SHA256 2b296bf4753f82ce8d311cc1de3c2e1adda32b309a060eddb7ae110d434c2ab9
MD5 d668066ee28bb15e4d1cb50eefa0185c
SHA1 b7498b5a5b235ee1eafc5973225616b89fb94739
SHA512 ad5260ec49bf53c06c2718fb66e0f5deb600b9e490c18d1dd4c4ab92f2a9ba434e9aa41c5ec72fae9de2b981d209ecf4f2e7a35a6780a971322bc58f01c69496
SSDEEP 3072:P1dVLvrc+VoekegD3wrLRlW3etAYJC0MJ:P1dVDrc+VoekeQgr1lW3esDJ
TLSH
T1D0C3AF34DA1AB06FD35E9874DA031D06CE62BCCA46A0BBCB57914CD20EE5F60DB2D781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup

crypt32

CryptStringToBinaryA

kernel32

WriteProcessMemory WriteFile CreateMutexA SuspendThread ResumeThread GetModuleHandleA Sleep GetLastError OpenMutexA InitializeSListHead LoadLibraryA CloseHandle VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateProcessW FreeLibrary FlushInstructionCache CreateRemoteThread GetCurrentProcess CreateFileA ReleaseSRWLockExclusive SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime AcquireSRWLockExclusive TerminateProcess

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memcpy memcmp __std_exception_copy __std_exception_destroy memmove __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-runtime-l1-1-0

_exit exit _register_thread_local_exe_atexit_callback _initterm _cexit _register_onexit_function _initterm_e terminate _get_narrow_winmain_command_line _c_exit _initialize_onexit_table _set_app_type _initialize_narrow_environment _invoke_watson _configure_narrow_argv _seh_filter_exe _crt_atexit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale