Behavioral task
behavioral1
Sample
2760-2-0x0000000000C70000-0x0000000001849000-memory.exe
Resource
win7-20240508-en
General
-
Target
2760-2-0x0000000000C70000-0x0000000001849000-memory.dmp
-
Size
11.8MB
-
MD5
5abad9db7a70c2932c14a50834cb38b4
-
SHA1
d7b09d9606776fd56a98fb938465504df11542f3
-
SHA256
d801f742c6208e630512c298f5e57eacb9cb17be9cc093545dc2f28ef91bc52b
-
SHA512
37393d5cbdcf15be7ae322c2a006108ddb0215eb5e01bf4a8b9d949bd5632e469ff9c6c65b76ff8c3b922a477303699857ebd609bba4e5fc0d2a6068ad8b3a7a
-
SSDEEP
98304:rCTY3MK8j+YJ30UHvggYGsWTnLNuCBs9lGi13dWp8MBxNsq+bBny8qDnm9KTpr:uTkebXYGTnBGlGUMB1+1y8qbtTp
Malware Config
Extracted
stealc
default
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2760-2-0x0000000000C70000-0x0000000001849000-memory.dmp
Files
-
2760-2-0x0000000000C70000-0x0000000001849000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 41KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE