Behavioral task
behavioral1
Sample
2968-46-0x0000000140000000-0x0000000140022000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2968-46-0x0000000140000000-0x0000000140022000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
2968-46-0x0000000140000000-0x0000000140022000-memory.dmp
-
Size
136KB
-
MD5
57a10aab067908eda73a90729faca9d3
-
SHA1
743cb87e879ae713674540b4e2f682af8ebe20b4
-
SHA256
5e7bd2b06e1abf16df1fdb79b220f818e00b0d5de4d1c972afd1c1c513999a95
-
SHA512
f337f90890d152f5e70e9663d0e25dc686b21e65e9451198a14bde0efaa07cb7466287cc6dc04c4d00a7a1ec2df736861d547d8f182cfa4d639f9ef93dca34bc
-
SSDEEP
1536:fOOYzPuJ+iCU2J4nakXr+vBUFMlY6Zn9dCfdGhhLzMFy4Qqj1bb/cZqduCidpiON:fOOYz2L2qnak0Zn1qlbU9nwBvU
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6350529534:AAEbFW9VBWTKQfN1Y3K_5RJARCtOn1UqK8o/sendMessage?chat_id=1467583453
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2968-46-0x0000000140000000-0x0000000140022000-memory.dmp
Files
-
2968-46-0x0000000140000000-0x0000000140022000-memory.dmp.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ