Mnemosyne[.]sys | Triage™

General

Target
Mnemosyne.sys
Size 18KB
Sample261107-tsykdads2v
SHA256 cc73f9c1f19db9eaff6d794d2a98f5fa9a296fea9e72997cb236f447cce7da87
MD5 9a629869225b7dedabc4426771c5f3a2
SHA1 737e11b414d2b1db5f28bab94943189a3f842cc3
SHA512 08a1ba09a80dd7e4c8081183d874d3c4c0fc66639b69cbbce680ab7f6c21c34f7933f89e77e30d0d88ca71a6a7c71389d49c4f662f5e6cb7908779de23674103
SSDEEP 384:ycfPE4az0m+pniytBjI3J4cT+yB0z3Tcv0jZwXPm:3fpQ3+JiaWZ4cT+yB0z3IvkSXP
TLSH
T10882F696E2B58169C0A383BD82F757B1B771F10B530226CF166C43251E1AFD4AA3F390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Mnemosyne.sys

File Explorer

Mnemosyne.sys

.sys 18KB

Mnemosyne.sys

SHA256 cc73f9c1f19db9eaff6d794d2a98f5fa9a296fea9e72997cb236f447cce7da87
MD5 9a629869225b7dedabc4426771c5f3a2
SHA1 737e11b414d2b1db5f28bab94943189a3f842cc3
SHA512 08a1ba09a80dd7e4c8081183d874d3c4c0fc66639b69cbbce680ab7f6c21c34f7933f89e77e30d0d88ca71a6a7c71389d49c4f662f5e6cb7908779de23674103
SSDEEP 384:ycfPE4az0m+pniytBjI3J4cT+yB0z3Tcv0jZwXPm:3fpQ3+JiaWZ4cT+yB0z3IvkSXP
TLSH
T10882F696E2B58169C0A383BD82F757B1B771F10B530226CF166C43251E1AFD4AA3F390
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

32868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\3.0\drivers\mnemosyne\Sys\amd64\Mnemosyne_x64.pdb

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Mnemosyne.sys

generic