Behavioral task
behavioral1
Sample
1100-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
1100-63-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230621-en
General
-
Target
1100-63-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
0818339c8a5c7c3d2e6533f8c5da67e3
-
SHA1
17655952f99f366480e73dd4dc63356fed58c9e4
-
SHA256
487f1df531ab46956955dcf4ecfe214a9f60ebaf8a9972a183348173659385ec
-
SHA512
fea662b9b108727db96de279ca5afc8a40aebb29499a2983177e1303c1d1719630b056d9b405dab679d8cea26ec98d675e63e22701191397d6d1ad7b9746c55b
-
SSDEEP
3072:Jw1/isRFuq4uyydWv3tafb7msC3wBPNZgbY:IiwFXsYbrNSb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.mosiacidona.com - Port:
587 - Username:
[email protected] - Password:
Chuksy1759
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1100-63-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
1100-63-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ