Behavioral task
behavioral1
Sample
2620-32-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2620-32-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2620-32-0x0000000000400000-0x0000000000448000-memory.dmp
-
Size
288KB
-
MD5
c4421c1e6f66a3e5532d3debcfd70767
-
SHA1
a5dbbbc6c27d0fab57c1d4813c3ac65293bd1b1b
-
SHA256
5ec10831592f7ed541466707eaec6a101e73e9cdf8744257751a074d579da5bc
-
SHA512
a1e921ed3168a8dda81acba3abdb09e35d147b786b9a7edaf028e2eabbc7ef6843e16ba1e6bca327a840968fa8c860ac983d7d1fe434ec98e3f0d4090da6b765
-
SSDEEP
3072:KrHj3Bxl2pyY8rXuSmjn2L86riXriCd48+UxHwMAwonf045byPELtso1ZYTVgait:nEUtBon5baELJub
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.inhousepick.com - Port:
587 - Username:
[email protected] - Password:
#(P%eO^#J0 - Email To:
[email protected]
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2620-32-0x0000000000400000-0x0000000000448000-memory.dmp
Files
-
2620-32-0x0000000000400000-0x0000000000448000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ