Behavioral task
behavioral1
Sample
2836-13-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2836-13-0x0000000000400000-0x0000000000424000-memory.exe
Resource
win10v2004-20231127-en
General
-
Target
2836-13-0x0000000000400000-0x0000000000424000-memory.dmp
-
Size
144KB
-
MD5
a0e0e86260a9f4961a92c7e9fa4ba7cf
-
SHA1
d66c02b8b6076cd671e8700c6128f0f3209e15cf
-
SHA256
6e455c775bc8dd45e1ca22bef8fe813d10f4bf1841f2fe74c3972c029f9c1257
-
SHA512
15cadea5447c3c1c3fbf121d175222b7e8697d8df5a3cdcec6685a26ce52a1a9ae36c4aa628a3b45cb33fd68a9902b0d4070236a8734bd3b02401f8e96f27242
-
SSDEEP
3072:Uyw1/isKBIz88TEtBDdbVqVARwB3nAgbY:aiCqBDdbonpb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.ozakaluminyum.com - Port:
587 - Username:
[email protected] - Password:
ETKghx*c3KoQ
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2836-13-0x0000000000400000-0x0000000000424000-memory.dmp
Files
-
2836-13-0x0000000000400000-0x0000000000424000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ