Behavioral task
behavioral1
Sample
1492-81-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1492-81-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1492-81-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
d587fa7d6decaf49d48c7455df0b9362
-
SHA1
635d49d7da195caf7c0a054988e40606dd2db908
-
SHA256
9447148df37a2cf86d14a2aa5d7330eaa16429dd6cac8747f4c98792b7e0f697
-
SHA512
0e4dd0ae9936b9ef629d79b2dc5daabe608bce6086402fb9799af7b8df427706ebdf28abf768fb8f582aa91fd8caac0869ce02531430fa5bb76c0e5ad6a28396
-
SSDEEP
3072:mOOYz2VWPIdSbP8d7VakpYlb7j+wBwT5gbY:HzCWKybaTyb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6029559841:AAEqr8_NCfqapJgAzw8PoPbqoCosnsk1VO0/sendMessage?chat_id=6033043077
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1492-81-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
1492-81-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ