Behavioral task
behavioral1
Sample
576-63-0x0000000000400000-0x0000000000466000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
576-63-0x0000000000400000-0x0000000000466000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
576-63-0x0000000000400000-0x0000000000466000-memory.dmp
-
Size
408KB
-
MD5
dbb602c8e02f38398dc49c52c893b7d6
-
SHA1
3dc8653c857170282fdbe8dc78b6d11fe21a249a
-
SHA256
1681e3adddc39c45a0430aec39f95293ec5e6d111fbba03dc2cfa1082791556a
-
SHA512
580c1f44b4aadccc396e450bd66965e8604488b2975a7406f5d21ca99109de055b8284d68e51f30a98a89d1288f44dc743ce07ee775eccb9ec38be30a4001dd9
-
SSDEEP
3072:Dst2KMj7bvaDybUroX467/D6tjlEAB5HzOnRfmARAAqA4HiTwJfZ6FXJ:D42NuObjSQABdOnRfmARALiTwJfIF
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.durainteriordesign.com - Port:
587 - Username:
[email protected] - Password:
blessme12345
Signatures
-
Snakekeylogger family
Files
-
576-63-0x0000000000400000-0x0000000000466000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 383KB - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ