Behavioral task
behavioral1
Sample
1804-3-0x00000000002E0000-0x00000000007E2000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1804-3-0x00000000002E0000-0x00000000007E2000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
1804-3-0x00000000002E0000-0x00000000007E2000-memory.dmp
-
Size
5.0MB
-
MD5
d3aa770875b5feb3837281ab9a8fd1df
-
SHA1
dd5d1eac445b0fc47661cd06894a07d77e43d6f8
-
SHA256
a9c9b52a4351023f44aa87149a8ecf1cb4c277e0e3b03fd3b75716c429205542
-
SHA512
effe12546442bd7a248bf43d07ba938a1207dd7b0fde00e64f76adcddf1601e1a6dbfdf3ffa9c14ce595c126f1c046c95124d1c2353d4321ce79a3914b30d150
-
SSDEEP
49152:HqR0aBWWOTWxWFbVUtJ6PmwoaGGFMdwRlpj4xDOOLDod6V:HqR/BvO6WFbVUtcPmfaGneRlRCKOLi
Malware Config
Extracted
stealc
rave
http://185.215.113.103
-
url_path
/e2b1563c6670f193.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1804-3-0x00000000002E0000-0x00000000007E2000-memory.dmp
Files
-
1804-3-0x00000000002E0000-0x00000000007E2000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 79KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rxxwmeko Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uspbccrz Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ