Behavioral task
behavioral1
Sample
2664-142-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2664-142-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2664-142-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
ea3c7e8557517d51021c2b09dc6b5ccc
-
SHA1
dd1387e23eb199dc86bf6b75a5f5b6735fdd60b3
-
SHA256
25d9be331ebe128c832dd2202485b2217417193880f6269bc644bcde6a86e9ad
-
SHA512
55a7bf7a0caa842f573b84f14ef64bf003413b0df556b21cbd439a86722c822fa33a36bddd23ab438763136a5acb5f2321acdb661146e84e3b989faee0b150a0
-
SSDEEP
3072:4yryRFro5j3+NW/3Sib7JpmttpfBSV0gbY:m5o5f1bhV1b
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.profdent.com.tr - Port:
587 - Username:
[email protected] - Password:
321123Muhasebe. - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2664-142-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
2664-142-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ