Behavioral task
behavioral1
Sample
3848-9-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
3848-9-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
3848-9-0x0000000000400000-0x0000000000424000-memory.dmp
-
Size
144KB
-
MD5
b0876bac0da83ad6ff31a7d713d2b710
-
SHA1
9f48ce2fbd8b3ed2c3852a557fffa57306f6b6df
-
SHA256
aa7b59d65f25a83e289987afac3468305c5566c9c4bf9fda1f54c01f826d3870
-
SHA512
5c365147a1a33591f905dd3867a2a2e25e36b12ed416537aa0a3fd92721f04ee77620ed3440bc8451948e375429ce58f066143991573940e123a34b284c480d4
-
SSDEEP
3072:86z9Jkn2xD8if0V/KEjsdb7wZzN8wBgxtgbY:1iAI/OdbcgxOb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.alualuminium.com.my - Port:
587 - Username:
[email protected] - Password:
U8G4S13#8Zk$ - Email To:
[email protected]
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3848-9-0x0000000000400000-0x0000000000424000-memory.dmp
Files
-
3848-9-0x0000000000400000-0x0000000000424000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ