Behavioral task
behavioral1
Sample
2236-8-0x0000000000580000-0x00000000005D2000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2236-8-0x0000000000580000-0x00000000005D2000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2236-8-0x0000000000580000-0x00000000005D2000-memory.dmp
-
Size
328KB
-
MD5
39e5829db651d965523ea2efd5191000
-
SHA1
9974f0a9bcf3e1c29d565fe040702d1913339581
-
SHA256
034caf30819268b4ea21776f9b248e872b909b65b1736cd75be01390143a6cfd
-
SHA512
6792cb7a7b7a466c56c22ce0963c13bb56f037b3a9c056b2441e94619e3cc24df3e39fc1f8c716a62fb855a7060fd83dc3af6e598ef2db398aa9f5e09bae94e4
-
SSDEEP
6144:CbCXSq5f+GULDdkdzk2PS+5eD5Yvp25W0Fse6se4WWi6X+bIeJUJAhQxIsh5QDFa:CbuXCPp5HOx67qmoK
Malware Config
Signatures
-
Agenttesla family
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2236-8-0x0000000000580000-0x00000000005D2000-memory.dmp
Files
-
2236-8-0x0000000000580000-0x00000000005D2000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 302KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ