memz_bootkiller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
memz_bootkiller.exe
Size 755KB
Sample260926-xbebys1tbx
SHA256 5c4e77fce970bbc2e30c151ea3c6f4e771413941cce0eb40ce649d06aaa2b371
MD5 61caeecb083c738ceb238413d77d994a
SHA1 5fb63042ba9e193c36ed7bfb24d24af58d144b1e
SHA512 99a5cb5701d7cb5540b2c179fceb58a1eb90a2da9b2afa8095563962c862920b8094693a5b99844c70cb309ee2d34a04963b501cdcb6758b86bab342acd6ce4b
SSDEEP 12288:Whe95B3XXRWh20UCUzHZ+dVTTGDwnbd2xd:Ws3RKUVHZKTWYbd2xd
TLSH
T107F43A47B3A49EEADC12663895CF631DA734FCB007929AC7671052216E47BE88D7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
memz_bootkiller.exe

File Explorer

memz_bootkiller.exe

.exe 755KB

memz_bootkiller.exe

IMPHASH 5e2cd0fe0349219332e06ab44add36db
SHA256 5c4e77fce970bbc2e30c151ea3c6f4e771413941cce0eb40ce649d06aaa2b371
MD5 61caeecb083c738ceb238413d77d994a
SHA1 5fb63042ba9e193c36ed7bfb24d24af58d144b1e
SHA512 99a5cb5701d7cb5540b2c179fceb58a1eb90a2da9b2afa8095563962c862920b8094693a5b99844c70cb309ee2d34a04963b501cdcb6758b86bab342acd6ce4b
SSDEEP 12288:Whe95B3XXRWh20UCUzHZ+dVTTGDwnbd2xd:Ws3RKUVHZKTWYbd2xd
TLSH
T107F43A47B3A49EEADC12663895CF631DA734FCB007929AC7671052216E47BE88D7FB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnableWindow ExitWindowsEx FindWindowW GetDC GetSystemMetrics LoadCursorA MessageBoxW SetCursor SetCursorPos SetWindowPos

gdi32

CreateSolidBrush DeleteObject PatBlt SelectObject

advapi32

AdjustTokenPrivileges CloseServiceHandle CreateProcessWithTokenW CreateServiceW DuplicateTokenEx LookupPrivilegeValueW OpenProcessToken OpenSCManagerA RegCloseKey RegCreateKeyExW RegSetValueExW StartServiceW

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func _assert __set_app_type __setusermatherr _aligned_free _aligned_malloc _amsg_exit _beginthreadex _cexit _commode atexit _errno _exit _fileno _fmode _initterm _lock _setmode _strtoi64 _strtoui64 _time64 _unlock _wcsicmp _wcstoi64 _wcstoui64 abort calloc exit fflush fprintf fputc fputwc free fwprintf getenv localeconv malloc memchr memcmp memcpy memmove memset rand realloc setvbuf srand strcmp strerror strlen strncmp strtol strtoul system vfprintf wcslen wcstol wcstoul

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FreeConsole GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadId InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFilePointer SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

Name

.text

Size

244KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

memz_bootkiller.exe

user32

gdi32

advapi32

msvcrt

kernel32

generic