Behavioral task
behavioral1
Sample
768-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
768-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
768-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
0a9cb6812d3b1d96feb9486367fd14f4
-
SHA1
bef76d9895e15ce765846b3b3427de974667a9e8
-
SHA256
4699318e6c088bbaf8fc5a0d47c0a3de796a6c53fa3908bb9ae156491fba8e71
-
SHA512
c1a897440e0d7befd469dc47f62f2bb8318ef94b42a6bd0c5c6f1be2998acf1b2bc541d5f523e8b79f0912f38e2d2646269b2945ca640259b80a4f548e04578c
-
SSDEEP
1536:ctMpEvqHEIsanVdLQPqsUr++MFjm1kXuHCjAfbKuE+arnETpiOWB:ctMKHgLBsUr+XmSuHCObfYrE9wB
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6175277595:AAFUeQAqIxy_tMM5DYmodWynDJwrUUHw-lo/sendMessage?chat_id=1467583453
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
StormKitty payload 1 IoCs
resource yara_rule sample family_stormkitty -
Stormkitty family
Files
-
768-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ