Behavioral task
behavioral1
Sample
2216-9-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2216-9-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2216-9-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
6a51aa7fe072841314b24ff328a18bb5
-
SHA1
3010bf4e5a66b69e0ea9e884dbea22bc17e48fa8
-
SHA256
efea5cdd865c9fa202ad4ea2daa0510ac979f85e0f7a31f437cb7d124f32b24f
-
SHA512
0fc51e8af0f7fe9f1f7293b110d2807ae3bea8c22c571ffa541c8dfb96efcd6dafa878729245f3347039bd42778ea30ff0f07307f0746c74dfda14baa8f35697
-
SSDEEP
3072:g69rDXrd6LsALoH5kL06Z9vPBNmkTdZ8ybSgg/mdcwvcXuId:j2sAEZkV5xZ3bHgHd
Malware Config
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2216-9-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
2216-9-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ