Behavioral task
behavioral1
Sample
2660-56-0x0000000000400000-0x0000000002435000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2660-56-0x0000000000400000-0x0000000002435000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2660-56-0x0000000000400000-0x0000000002435000-memory.dmp
-
Size
32.2MB
-
MD5
ced7aa2146936b864799fc254ff4baf3
-
SHA1
06c106f179eefdb66e4ab6b349e3ee8a72a6669e
-
SHA256
f0ca290a37bdab073602446cb85b0cb50d6a6bec8318cf468fde98b6ea78e185
-
SHA512
ac772e6725e0754140b371dc2d345ede804da2e8656353126be9455116dcb25dece0ade6de386a81a2b075c81e035b329164b6db2ad28b6c7c597a03e3ff86c9
-
SSDEEP
1536:Cusb7stfbqffbMny0eDEgU5ZOw9mbNFG7x6pt9Dvdp8R+jHb546+qUlE4SJrImJ5:3sbymMy0117esKhpV46+8rawdBqI3
Malware Config
Extracted
stealc
http://adriaenclaeys.top/e9c345fc99a4e67e.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2660-56-0x0000000000400000-0x0000000002435000-memory.dmp
Files
-
2660-56-0x0000000000400000-0x0000000002435000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ