Behavioral task
behavioral1
Sample
1440-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1440-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1440-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
6da6d896c666fd032c332560c1c33b06
-
SHA1
4a963323eadf8a72be3f473394e9cda52a48a278
-
SHA256
c7b9be2da7ff1313e1ff0a9097414434c8e8bab25ecea559b54dc192b41f2b7d
-
SHA512
ab4043ef172c96def697d64febe3010aec888f96f1bc23a446dd1d9bbc08b2093efc509fee82511610a9232b1e275906972a24782939cf45ac7fc1cc038967ed
-
SSDEEP
3072:lFlAi/s+PkZu0eLTcauUcrRb8ikhZwBl:TvpDqRbaW
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5164987354:AAFbwY5baNRyoCilWU25jL6nSQnU8yn8vuc/sendMessage?chat_id=5184071093
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1440-63-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
1440-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ