Behavioral task
behavioral1
Sample
4896-135-0x0000000000400000-0x000000000046A000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4896-135-0x0000000000400000-0x000000000046A000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
4896-135-0x0000000000400000-0x000000000046A000-memory.dmp
-
Size
424KB
-
MD5
9460b51432081e48a3918e9e4cecb40b
-
SHA1
beabe254036f35d5255e919fb33109be75611271
-
SHA256
2fc600cce00982649089d4c384a1b0bb9c1bb149d0cbb3e0682d5330f3ee575f
-
SHA512
84638c82f9a054404194b39ddc3acc29f5991de994aed6f18109b222e7ddba19b265d255a0627b3deb854c6c710bdf9dc45c80d64d2c5c3f1fc92b18fcb3bb96
-
SSDEEP
3072:JMH0sgdNkpmc/aOAB/vA3ikQjLNln0XzqZ2pyU4Hi8fvVM6FX7:CUXBRdBA3ikQjZln0X2Z2pybi8fvV3F
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.sgyemek.com.tr - Port:
587 - Username:
[email protected] - Password:
Muhasebe2019+
Signatures
-
Snakekeylogger family
Files
-
4896-135-0x0000000000400000-0x000000000046A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 393KB - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ