Behavioral task
behavioral1
Sample
2704-14-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2704-14-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2704-14-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
2e4899cda889930a9d7d2c7e5ea70e83
-
SHA1
3c706adff386067ca9968d914b5141b9fc9b934c
-
SHA256
b3f744b7f4279ee2acc7c42eb7f2372a04ae94ad8a648bae7c8cf10458f422de
-
SHA512
aef2f0d786c341d20dcd5f49c403968128b1d25ad9d0ef3a556346dc4323df6b18ce9c504780c90e6ab00eb7659211b85f786b1add73c3f67bba9f071e0aeeef
-
SSDEEP
3072:It1PdhaH88ECg9s3X2zb5MHdmmWOwvcXbYgbY:WdUd2biHvhb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7985379579:AAFFNXAHJz6n24A6xEGgMMms826UxvjorNA/sendMessage?chat_id=6370711846
Signatures
-
Snake Keylogger payload 1 IoCs
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2704-14-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
2704-14-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ