Behavioral task
behavioral1
Sample
2520-10-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2520-10-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2520-10-0x0000000000400000-0x0000000000424000-memory.dmp
-
Size
144KB
-
MD5
e4dc04bcd3bc6a6d8db1b9b040d6be34
-
SHA1
8dfd63cf9adcfdae3f85ab6be7e57f25feda476d
-
SHA256
a7f07cb3c33cf95586e0a95c3f857156f1413e845495362d3519d2e994e9ac5b
-
SHA512
ba1f36692526ae48001b0a05590d90d1924659ec85fc52f0a91052dedf5d98c40f5056ea0ab800631cc9bf11f02bcf92a2fcbff6fca69643d0fad0619fd84f3a
-
SSDEEP
1536:Yiz9LdzDWDQMjnCfxD8AK+vBUFMlY6f09xTnF/VkvIMF+qscTuEb/zbhiHeqappX:Yiz9Jkn2xD8if0OscCEb7FiHHarwBgx
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.hostedemail.com - Port:
587 - Username:
[email protected] - Password:
A@thirst@ACC - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2520-10-0x0000000000400000-0x0000000000424000-memory.dmp
Files
-
2520-10-0x0000000000400000-0x0000000000424000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ