Behavioral task
behavioral1
Sample
3004-0-0x0000000000660000-0x0000000000B5D000-memory.exe
Resource
win7-20241010-en
General
-
Target
3004-0-0x0000000000660000-0x0000000000B5D000-memory.dmp
-
Size
5.0MB
-
MD5
d5084a7ffe6d72ab9248d5dc8a42b23d
-
SHA1
e1ff15cfe642d0c3a2a9fb9fb783ab13f46337a8
-
SHA256
d3bfcaff6a7670a576720817a56961068cc83f9757e421d59064115e76aa1297
-
SHA512
dc0346d41d986dc0ff1224670dd9bcc104932ba8a284fab08a9a2a8672c556abf8e122d03efd16767f930179d72b8e697a314e528069f55bf87d56192f3e7c38
-
SSDEEP
49152:7Hx2Y/JerNUDz7zu4YRB0xNCxkZF27NwZRso5q6:d2Y/JerNUDz7zuhRiNC2AN
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3004-0-0x0000000000660000-0x0000000000B5D000-memory.dmp
Files
-
3004-0-0x0000000000660000-0x0000000000B5D000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
csrlwcus Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
amtrozjl Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE