Behavioral task
behavioral1
Sample
McGen.exe
Resource
win10v2004-20231215-en
General
-
Target
McGen.exe
-
Size
1.6MB
-
MD5
a4c1bfcfe56368de9ffb5ca2a6e81b7e
-
SHA1
ae5a6aef9100da3d9aee2b0e762382094e0c879e
-
SHA256
2a0f9a08fc9b79e28ff8c527eaee816b12c24ff947f781ed049d5ea0408f885d
-
SHA512
32cbd44f3600fa50f4424753a49f48ae04057c099c9442ba4217faac3f907b9400dc26a56bbd95297a5295982914f6fa0897a5a789fe32575d977fb9ccfda336
-
SSDEEP
49152:1kTq24GjdGSiqkqXfd+/9AqYanieKds+d:11EjdGSiqkqXf0FLYW
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1197224341901938759/wLjyGgVEBqObJK1n6Mhygan_HAFt4E4fZuNMoRr9wTg9rwDHYI2JTbhPys_V3v5lHtnq
Signatures
-
Stealerium family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource McGen.exe
Files
-
McGen.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ