Behavioral task
behavioral1
Sample
2508-8-0x0000000000400000-0x0000000000645000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2508-8-0x0000000000400000-0x0000000000645000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2508-8-0x0000000000400000-0x0000000000645000-memory.dmp
-
Size
2.3MB
-
MD5
8e19626f0fa3fce7520d7a762be22ce7
-
SHA1
a99afccb9a84dc26379662b267d59765bce4700f
-
SHA256
35db7a6855cc0c39bd487e6436d3b0013f54ab0e055a375fa0fdeda4af3a89ba
-
SHA512
4be0e28c39cc24222224329197a5531c1e4b9d3ce1a5e238175a6b2b69edd01ac3534206537460fe390ce0d06a8298a4750891592f2e877a1ce3ad6a1ac627cd
-
SSDEEP
3072:0z63TZcqNNrry1kYGpQ7EwaRA1kI7cEjL44fZiCR61K:0z6Vxvy1NGpQgoz7PL7xi
Malware Config
Extracted
vidar
8
08109f27e07d3765804411ff9d579338
https://steamcommunity.com/profiles/76561199644883218
https://t.me/neoschats
-
profile_id_v2
08109f27e07d3765804411ff9d579338
-
user_agent
Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78
Signatures
Files
-
2508-8-0x0000000000400000-0x0000000000645000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ