stealc | 188020x00000000004000000x000000000062D000memory_JC[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

188020x00000000004000000x000000000062D000memory_JC.dmp
Size

2.2MB
MD5

8e5c2ecf316d935d943b8c17d4020c1f
SHA1

cdead90ed086f232a1959c54fddcde8c696ef6b4
SHA256

325f5c275c4ce268980d9427b1993e0151aeaace3402ad6a8adf2ef066808119
SHA512

0a069728f0c02dad4435541381b0c56ba0ecc75e9d60fef7e29873ec1cab4bd8ac7bd2847395378defa732762eb36f7c17187ae04c475a6d8196117d12d8d887
SSDEEP

3072:KwZx7tPwbpTK8Q5Uzf4JElJvIT4nZefRq:bZ1xwbJKAzAElJA8YZ

Score

10^/10

stealc

Malware Config

Signatures

Stealc family
stealc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
188020x00000000004000000x000000000062D000memory_JC.dmp

Files

188020x00000000004000000x000000000062D000memory_JC.dmp
.exe windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ