Behavioral task
behavioral1
Sample
2540-0-0x00000000002C0000-0x000000000096B000-memory.exe
Resource
win7-20240903-en
General
-
Target
2540-0-0x00000000002C0000-0x000000000096B000-memory.dmp
-
Size
6.7MB
-
MD5
5d8743bd1c6d30417c3ee14dad337849
-
SHA1
cb138b58635defee4bed7a1edc155ca794488627
-
SHA256
1bb924397ad22f29f2a8ba9413e23580ceccc85d97b92796b1ffb89dc018cf6d
-
SHA512
43cf9d4532d02a30b21132fd019385455918bc986c1ea551b1c5b0ef610d910e75a5271b27008b21a5e6fe5e0a72410f8e2e7df4ccadeaa65574338342491052
-
SSDEEP
3072:nxfYfLZaI+5UoQNKif0uX4x4lq7iwOKu2Yoqg7WWSb1c4:nRi9luUoQNKduoxXj/rqg7WWSL
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2540-0-0x00000000002C0000-0x000000000096B000-memory.dmp
Files
-
2540-0-0x00000000002C0000-0x000000000096B000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 138KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vsethdti Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ypmwblrh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE