Behavioral task
behavioral1
Sample
220-0-0x0000000000FF0000-0x0000000001687000-memory.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
220-0-0x0000000000FF0000-0x0000000001687000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
220-0-0x0000000000FF0000-0x0000000001687000-memory.dmp
-
Size
6.6MB
-
MD5
b16df2001c7408b5458550726efc23f5
-
SHA1
a95b94d4f4cb48b203afff35fba707a799b1a5ea
-
SHA256
5e9b5aefa8252c0d7c3ef2a286a1aa096e7fd8f391f18722e0edee7a40e086c8
-
SHA512
1b565414233f61bd47bec87f0ad04d129eb92df288c006260e5c4b1d05225596cbe35ed8e36bd540a8aca37bac9630f808197ecad9599e1232585dae14825380
-
SSDEEP
3072:NJAnWsN98GJkh1V0GzTfQ2u2FE/xZoOJ1gbIrWnXbxdUhViv+Q98Xwh:3Ab9HJGnzrQTZoO7gZXbxdiMvzqO
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 220-0-0x0000000000FF0000-0x0000000001687000-memory.dmp
Files
-
220-0-0x0000000000FF0000-0x0000000001687000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zorlwsmx Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cpkpvzxx Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE