Behavioral task
behavioral1
Sample
4508-235-0x0000000000400000-0x0000000000629000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4508-235-0x0000000000400000-0x0000000000629000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4508-235-0x0000000000400000-0x0000000000629000-memory.dmp
-
Size
2.2MB
-
MD5
d7c1895fd4c3cdfe02f1354cee115697
-
SHA1
bdab4d765baeeaa5fa8735023b2f2fa045c7a739
-
SHA256
e34b79b6cd932238b84b9ce96082f77685f9266d67f19f7034a5789318c8ebd7
-
SHA512
3df022bb0d3c12c169d9aa882f92c129f0c0cdf86c02a3e6570d464193d184472c7fc666edb39ae6e61ef88e30aed0992be918ff7dddbdfcafa3d750ec7d435d
-
SSDEEP
24576:Xo+v03JpTD2Ch26+8ROqIK6BGbVGGy7dVI773t1M4r+0RbSHxTVwPrYIc:X
Malware Config
Extracted
stealc
http://5.78.104.48/d130c39575999622.php
Signatures
Files
-
4508-235-0x0000000000400000-0x0000000000629000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ