Behavioral task
behavioral1
Sample
2296-0-0x0000000001220000-0x00000000018BB000-memory.exe
Resource
win7-20240903-en
General
-
Target
2296-0-0x0000000001220000-0x00000000018BB000-memory.dmp
-
Size
6.6MB
-
MD5
e46a9a2ae161f500fa64bbbc764ba175
-
SHA1
3fea9bdaa2951c416f588293295924d9c3fff711
-
SHA256
c26ad6ba380ebf36adcd3cefd6f43de9a9957c894207e2baa3354b5958d881ab
-
SHA512
7b265f02e0c0203bc6b3c7e57814ca0ccf161b21839009a956cd0ffc09bd368dcefe0af5ec2facc1360009003685d4b1afb0973c3332cfb95b6867d047559083
-
SSDEEP
3072:yaYHqnfWVtBaIjAoeESamaBhi18f4uVTbM+PsqTETjUqtNaVzD:yasQuvBFjAoeESapiODdfPh7qtozD
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2296-0-0x0000000001220000-0x00000000018BB000-memory.dmp
Files
-
2296-0-0x0000000001220000-0x00000000018BB000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 138KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ukeoikuf Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xmgaqbkn Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE