Behavioral task
behavioral1
Sample
2144-26-0x0000000000400000-0x00000000010CC000-memory.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2144-26-0x0000000000400000-0x00000000010CC000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2144-26-0x0000000000400000-0x00000000010CC000-memory.dmp
-
Size
12.8MB
-
MD5
7acb8eba2313b66026bb6e976ba75ca9
-
SHA1
44025c263df667d443c0def4586b4864a737d3f2
-
SHA256
c23591ebe19d5c0778d037cc71ea089aef3fe86d54c26ce4b08302dcfcdb1394
-
SHA512
738c36de6ade01cd6f81ca0cc8b6c8f2ec322fddf127a6a4775cd23b0a188660c10714f17b3e36081afc752554a19f2b5a8ccd31bc90bd3a349278c1b6d798b7
-
SSDEEP
196608:JuKYXfSXOF4P0Fx2vWnr5Hddx2xaP++ZgsVjcjSPrRL:NYXrnhp
Malware Config
Extracted
stealc
LogsDiller
http://92.119.114.51
-
url_path
/2048ca003d511226.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2144-26-0x0000000000400000-0x00000000010CC000-memory.dmp
Files
-
2144-26-0x0000000000400000-0x00000000010CC000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 4.9MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE