Behavioral task
behavioral1
Sample
4052-1463-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
4052-1463-0x0000000140000000-0x0000000140024000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
4052-1463-0x0000000140000000-0x0000000140024000-memory.dmp
-
Size
144KB
-
MD5
ee0a7dd4e8a87b70bc09731a7b4a2b22
-
SHA1
b9101d76ad5cbe512e716d603906bc77302a3feb
-
SHA256
987440523a22f8e55c1af4dc24d4d88f9ef19e43aab11eec877e9c2b1fb061b6
-
SHA512
e554e1e3a53657e2062880463ee427292bf4a322649dff0d45000cea696261d7d3970632e398b713be7012324ea73f89291a3c0a0977564e5c096afb82e240e3
-
SSDEEP
3072:qOOYz2l2PIdSd6blMbUenobjCwBjRIDbY:7z+pyb/QRab
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6307849414:AAGmDbHsZCN3tscyYeUw89m9JtBbXMioogc/sendMessage?chat_id=5582419717
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4052-1463-0x0000000140000000-0x0000000140024000-memory.dmp
Files
-
4052-1463-0x0000000140000000-0x0000000140024000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ