Behavioral task
behavioral1
Sample
1928-12-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1928-12-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
1928-12-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
b57add58d8e85668f310c43653891d50
-
SHA1
a52107a656848500f3e65a5041aef2651c76bd5d
-
SHA256
ff2ea0b7e70feaefccaa253b6bb4fd610aa459c3cb305528017c94af0e7fc487
-
SHA512
af73f919f7e7372da28c9016ecbb8ac54c10e2befd9e2bc9e5a65357b8b1fc41f86bbbb31ead03e82d3d842ac57a3ff2c03a8fb41a06a454c5623ef0e41e3139
-
SSDEEP
3072:7nEMnPqsUxLFVqPJ8h49zbnblYe2E9mdbwvcX2os3igbY:vPqskLFCtbnbOetIs3rb
Malware Config
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1928-12-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
1928-12-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ